NAVAL 

POSTGRADUATE 

SCHOOL 

MONTEREY,  CALIFORNIA 


THESIS 


NETWORK  VULNERABILITY  ASSESSMENT  OF  THE 
U.S.  CRUDE  PIPELINE  INFRASTRUCTURE 

by 

Michael  D.  Larranaga 
September  2012 

Thesis  Co- Advisors:  Rudy  Darken 

Ted  Lewis 


Approved  for  public  release;  distribution  is  unlimited 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


REPORT  DOCUMENTATION  PAGE 


Form  Approved  OMB  No.  0704-0188 

Public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instruction, 
searching  existing  data  sources,  gathering  and  maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send 
comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information,  including  suggestions  for  reducing  this  burden,  to 
Washington  headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington,  VA 
22202-4302,  and  to  the  Office  of  Management  and  Budget,  Paperwork  Reduction  Project  (0704-0188)  Washington  DC  20503. 

2.  REPORT  DATE  3.  REPORT  TYPE  AND  DATES  COVERED 

September  2012  Master’ s  Thesis 

4.  TITLE  AND  SUBTITLE  Network  Vulnerability  Assessment  of  the  U.S.  Crude  5.  FUNDING  NUMBERS 
Pipeline  Infrastructure _ 

6.  AUTHOR(S)  Michael  D.  Larranaga 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES)  8.  PERFORMING  ORGANIZATION 

Naval  Postgraduate  School  REPORT  NUMBER 

9.  SPONSORING  /MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES)  10.  SPONSORING/MONITORING 
N/A  AGENCY  REPORT  NUMBER 

11.  SUPPLEMENTARY  NOTES  The  views  expressed  in  this  thesis  are  those  of  the  author  and  do  not  reflect  the  official  policy 
or  position  of  the  Department  of  Defense  or  the  U.S.  Government.  IRB  Protocol  number _ N/A _ . 


13.  ABSTRACT  (maximum  200  words) 

The  potential  for  cascade  failure  of  the  U.S.  crude  oil  pipeline  infrastructure  is  analyzed  using  Model  Based  Risk 
Assessment  software.  The  pipeline  system  that  distributes  crude  oil  to  refineries  across  the  United  States  has  gained 
much  media  attention  with  President  Obama’s  denial  of  a  permit  to  complete  a  key  portion  the  Keystone-XL  pipeline 
that  will  carry  oil  from  Alberta,  Canada  to  the  Cushing  Oil  Trading  Hub  (COTH)  in  Cushing,  OK.  The  analysis 
identified  the  COTH  as  the  primary  critical  hub.  The  COTH  is  one  of  the  world’s  major  oil  terminals.  A  disruption  of 
the  COTH,  Midwest/West  Coast  oil  distribution  networks,  or  critical  hubs  would  have  far-reaching  negative 
consequences  affecting  global  trade.  The  analysis  also  identified  regional  differences  in  network  resiliency  and 
susceptibility  to  cascade  failure.  Protecting  all  55,000  miles  of  the  U.S.  crude  oil  pipeline  infrastructure  from 
catastrophic  failure  is  an  unachievable  goal,  but  protection  of  the  network  from  cascade  failure  and  a  Black  Swan 
event  can  be  achieved  by  protecting  network  hubs.  The  results  of  this  analysis  should  be  used  as  a  starting  point  to 
increase  network  resiliency  and  prioritize  the  use  of  resources  to  secure  the  crude  oil  pipeline  network  against  cascade 
failure. 


16.  PRICE  CODE 


NSN  7540-01-280-5500  Standard  Form  298  (Rev.  2-89) 

Prescribed  by  ANSI  Std.  239-18 


20.  LIMITATION  OF 
ABSTRACT 


15.  NUMBER  OF 
PAGES 

85 


14.  SUBJECT  TERMS  Critical  Infrastructure,  Crude  Oil  Pipeline,  Probable  Maximum  Loss,  Model 
Based  Risk  Analysis,  Risk  Assessment,  Risk  Management,  Black  Swan,  Network  Analysis,  Fat  Tail, 
Simulation,  Pipeline  Safety,  Safety  Management 

18.  SECURITY 
CLASSIFICATION  OF  THIS 
PAGE 

Unclassified 


19.  SECURITY 
CLASSIFICATION  OF 
ABSTRACT 

Unclassified 


17.  SECURITY 
CLASSIFICATION  OF 
REPORT 

Unclassified 


12b.  DISTRIBUTION  CODE 

A 


12a.  DISTRIBUTION  /  AVAILABILITY  STATEMENT 

Approved  for  public  release;  distribution  is  unlimited 


1.  AGENCY  USE  ONLY  (Leave  blank) 


1 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


11 


Approved  for  public  release;  distribution  is  unlimited 

NETWORK  VULNERABILITY  ASSESSMENT  OF  THE 
U.S.  CRUDE  PIPELINE  INFRASTRUCTURE 

Michael  D.  Larranaga 

Simplex  Professor,  School  of  Fire  Protection  and 
Safety-Oklahoma  State  University,  Stillwater,  Oklahoma 
Member,  Board  of  Scientific  Counselors-Centers  for  Disease  Control  and  Prevention- 
National  Institute  for  Occupational  Safety  and  Health,  Washington,  DC 
B.S.,  Oklahoma  State  University,  1996 
M.S.,  University  of  Houston  Clear  Lake,  1998 
Ph.D.,  Texas  Tech,  2004 


Submitted  in  partial  fulfillment  of  the 
requirements  for  the  degree  of 

MASTER  OF  ARTS  IN  SECURITY  STUDIES 
(HOMELAND  SECURITY  AND  DEFENSE) 

from  the 

NAVAL  POSTGRADUATE  SCHOOL 
September  2012 


Author:  Michael  D.  Larranaga 


Approved  by:  Rudy  Darken 

Thesis  Co-Advisor 


Ted  Lewis 
Thesis  Co-Advisor 


Daniel  Moran 

Chair,  Department  of  National  Security  Affairs 


THIS  PAGE  INTENTIONALLY  LEFT  BLANK 


IV 


ABSTRACT 


The  potential  for  cascade  failure  of  the  U.S.  crude  oil  pipeline  infrastructure  is  analyzed 
using  Model  Based  Risk  Assessment  software.  The  pipeline  system  that  distributes  crude 
oil  to  refineries  across  the  United  States  has  gained  much  media  attention  with  President 
Obama’s  denial  of  a  permit  to  complete  a  key  portion  the  Keystone -XL  pipeline  that  will 
carry  oil  from  Alberta,  Canada  to  the  Cushing  Oil  Trading  Hub  (COTH)  in  Cushing,  OK. 
The  analysis  identified  the  COTH  as  the  primary  critical  hub.  The  COTH  is  one  of  the 
world’s  major  oil  terminals.  A  disruption  of  the  COTH,  Midwest/West  Coast  oil 
distribution  networks,  or  critical  hubs  would  have  far-reaching  negative  consequences 
affecting  global  trade.  The  analysis  also  identified  regional  differences  in  network 
resiliency  and  susceptibility  to  cascade  failure.  Protecting  all  55,000  miles  of  the  U.S. 
crude  oil  pipeline  infrastructure  from  catastrophic  failure  is  an  unachievable  goal,  but 
protection  of  the  network  from  cascade  failure  and  a  Black  Swan  event  can  be  achieved 
by  protecting  network  hubs.  The  results  of  this  analysis  should  be  used  as  a  starting  point 
to  increase  network  resiliency  and  prioritize  the  use  of  resources  to  secure  the  crude  oil 
pipeline  network  against  cascade  failure. 
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I.  INTRODUCTION 


The  United  States  has  an  overwhelming  dependency  on  crude  oil  and  is  the 
largest  consumer  of  crude  oil  in  the  world.  It  leads  the  world  in  oil  consumption,  and 
consumes  approximately  19  million  barrels  of  crude  oil  per  day,  or  two-thirds  more  than 
that  of  the  European  Union  and  double  the  consumption  of  China,  which  are  second  and 
third  in  world  oil  consumption,  respectively.1  For  the  United  States  to  move  such  a  large 
volume  of  oil  across  the  country,  a  massive  pipeline  network  was  developed  that  began  in 
the  19th  century.  The  purpose  of  this  project  was  to  assess  the  nation’s  crude  oil  pipeline 
network  and  identify  the  hubs  that  would  have  the  greatest  impact  if  their  operation  were 
disrupted  by  a  terrorist  attack,  natural  disaster,  or  other  catastrophic  event. 

Crude  oil  pipeline  infrastructure  is  critical  to  the  North  American  energy  supply 
chain  that  has  evolved  substantially  over  the  past  century.  The  U.S.  economy  relies 
almost  completely  on  crude  oil  pipelines  as  critical  infrastructure  for  enabling  business, 
transportation,  heating  and  energy  production,  petrochemical  production,  raw  materials 
for  manufacturing,  lubrication  products,  and  hundreds  of  other  uses  critical  to  the 
American  way  of  life.  Without  the  daily  delivery  of  crude  oil  to  U.S.  refineries  via  the 
vast  and  complex  network  of  crude  oil  pipelines,  the  U.S.  economy  would  rapidly  decline 
and  become  unsustainable. 

Prior  to  the  passage  of  pipeline  safety  legislation  in  2002,  pipeline  safety  and 
security  were  not  considered  a  priority  by  government  regulators.2  In  1968, 3  Congress 
created  the  main  regulatory  body,  the  Office  of  Pipeline  Safety  (OPS)  within  the 
Department  of  Transportation  (DOT)  to  conduct  a  “national  program  to  ensure  the  safe, 
reliable  and  environmentally  sound  operation  of  the  Nation's  pipeline  transportation 


1  “CIA-The  World  Factbook,”  (n.d.),  https://www.cia.gov/library/publications/the-world- 
factbook/rankorder/2 1 74rank.html. 

2  Carol  Parker,  “The  Pipeline  Industry  Meets  Grief  Unimaginable:  Congress  Reacts  with  the  Pipeline 
Safety  Improvement  Act  of  2002,”  Natural  Resources  Journal  44,  no.  1  (2004):  244-282. 

3  Ibid. 
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system.”4  In  1978,  the  General  Accounting  Office  (GAO)  reported  that  OPS  had  weak 
enforcement,  maintained  inaccurate  records,  and  administered  ineffective  rules.  In  2000, 
the  GAO  again  reemphasized  its  1978  findings  that  criticized  the  OPS  for  its 
unwillingness  to  work  with  states  to  improve  pipeline  safety  and  its  weak  enforcement  of 
safety  rules.5  As  of  2001,  OPS  did  not  maintain  an  accurate  map  of  the  pipelines  it 
regulated.  Additionally,  OPS  had  the  lowest  implementation  rate  of  National 
Transportation  Safety  Board  (NTSB)  recommendations  of  any  agency  in  DOT.  The 
NTSB,  DOT  Inspector  General,  American  Petroleum  Institute  and  both  houses  of 
Congress  were  critical  of  OPS’s  poor  history  of  accident  data  collection,  regulation,  and 
enforcement  of  existing  regulations.6 

In  a  review  of  319  pipeline  safety  related  journal  articles  from  1971-2000  that 
identified  trends  by  frequency  of  keyword  content  analysis  methodology,  Larranaga  and 
Sandoval  found  an  exponential  growth  rate  in  keyword  frequency  or  pipeline  safety 
related  terms  per  time  period  in  the  published  literature.  The  number  of  journal  articles 
published  from  1971-2000  grew  exponentially  per  time  period,  which  indicated  an 
increasing  awareness  of  pipeline  safety  issues  in  the  scientific  community.  See  Figure  1. 
During  these  same  time  periods,  the  frequency  of  use  of  the  term  “legislative/regulation” 
increased  237%,  the  keyword  “accidents”  increased  244%,  and  the  tenn  “safety 
management”  increased  408%. 7  Despite  the  increased  awareness  of  safety  related  issues 
in  the  scholarly  literature,  it  took  several  catalyzing  incidents  from  1999-2001  to 
generate  the  impetus  for  new  pipeline  safety  legislation. 


4  DOT-PHMSA,  “PHMSA — Organization — Office  of  Pipeline  Safety,”  (n.d.), 
http://www.phmsa.dot.gov/portal/site/PHMSA/menuitem.ebdc7a8a7e39f2e55cf2031050248a0c/7vgnextoid 
=ca9fe4fca03  80 1  lOVgnVCMl  00000762c7798RCRD&vgnextchannel=893  8 1 433  89d8c0 1  OVgnVCM  1000 
008049a8c0RCRD&vgnextfmt=print. 

5  Parker,  “The  Pipeline  Industry  Meets  Grief  Unimaginable:  Congress  Reacts  with  the  Pipeline  Safety 
Improvement  Act  of  2002.” 

6  Ibid. 

7  Michael  D.  Larranaga,  and  Angela  Sandoval,  “Current  Safety  Issues  Associated  with  Natural  Gas 
Transportation  and  Distribution,”  presented  at  the  X  Congreso  y  Exposicion  Iberoamericana  de 
Tecnologias  en  Prevencion  de  lncendio,  Proteccion  Ambiental  y  Seguridad  Industrial  SEGUR-Fire  2001, 
Caracas,  Venezuela,  July  2001. 
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Figure  1.  Pipeline  Safety  Related  Journal  Publications  per  Time  Period 


These  major  incidents  led  to  President  Bush  to  sign  the  new  Pipeline  Safety 
Improvement  Act  of  2002,  which  capped  years  of  effort  to  strengthen  pipeline  safety  laws 
by  the  NTSB,  state  agencies,  and  others,  including  victims  of  pipeline  accidents  that 
included  the  following.8 

•  1999,  Bellingham,  Washington — approximately  250,000  gallons  of 
gasoline  spilled  from  a  ruptured  pipeline/explosion.  Three  children  were 
killed  and  a  fireball  1.5  miles  long  was  sent  through  a  city  of 
approximately  70,000  people.  The  explosion  created  a  mushroom  cloud  6 
miles  high  and  damage  claims  exceeded  half  a  billion  dollars. 

•  2000  Carlsbad,  New  Mexico — An  El  Paso  Energy  natural  gas  pipeline 
explosion  killed  12  campers  from  a  single  family.  This  incident 
contributed  significantly  to  the  California  energy  crisis  of  2001.  The 
governor  of  New  Mexico  referred  to  the  scene  as  “grief  unimaginable.” 


8  Parker,  “The  Pipeline  Industry  Meets  Grief  Unimaginable:  Congress  Reacts  with  the  Pipeline  Safety 
Improvement  Act  of  2002.” 
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•  2000  Dallas,  Texas — The  rupture  of  a  gasoline  pipeline  resulted  in  a 
contaminated  water  supply,  which  led  to  $2. 75/gallon  gasoline  and  lower 
air  quality  in  Chicago  and  Milwaukee. 

•  2000,  Michigan — A  gasoline  pipeline  rupture  caused  more  than  1,200 
people  to  evacuate  their  residences,  and  some  for  more  than  3  months. 

•  2000,  Maryland — A  fuel  oil  pipeline  rupture  contaminated  miles  of  the 
Patuxent  River,  which  resulted  in  clean  up  costs  of  $7 1  million. 

An  additional  227  pipeline  failures  occurred  in  the  year  2000  that  caused  a  record 
$197  million  in  property  damage  and  the  highest  number  of  fatalities  in  25  years.  Two 
catastrophic  events  associated  with  security  and  pipelines  were  the  venerable  “straw  that 
broke  the  camels  back”  and  catalyzed  change  in  pipeline  safety  legislation.  The  first  was 
the  September  11,  2001  terrorist  attacks,  and  the  second,  just  one  month  later,  was  a  lone 
gunman  who  fired  a  rifle  at  the  Trans-Alaska  pipeline  and  created  a  leak  that  shut  down 
one-fifth  of  domestic  oil  production.9  Both  these  security  incidents  highlighted  the 
vulnerability  of  pipelines  to  security  breaches.  Although  the  pipeline  safety  and  security 
bill  was  introduced  in  the  House  as  the  “Pipeline  Infrastructure  Protection  to  Enhance 
Security  and  Safety  Act,”  political  considerations  removed  all  sections  expressly 
addressing  security,  which  resulted  in  the  final  bill  being  the  “Pipeline  Safety 
Improvement  Act  of  2002. ”10 

Following  the  September  11,  2001  terrorist  attacks,  the  Department  of  Homeland 
Security  (DHS)  was  created  by  integrating  22  existing  departments  within  the  federal 
government.  One  of  these  departments,  the  Transportation  Safety  Administration  (TSA), 
was  given  the  responsibility  of  overseeing  the  country’s  pipeline  security.  TSA  has  built 
on  OPS’s  previous  security  recommendations  to  operators,  and  both  agencies  are  now 
working  together  to  ensure  the  nation’s  pipelines  are  both  safe  and  secure.11 


9  Parker,  “The  Pipeline  Industry  Meets  Grief  Unimaginable:  Congress  Reacts  with  the  Pipeline  Safety 
Improvement  Act  of  2002.” 

10  Ibid. 

11  U.S.  Library  of  Congress,  Congressional  Research  Service,  America ’s  Pipelines  Safe  and  Secure: 
Key  Issues  for  Congress,  by  Paul  W.  Parfomak,  CRS  Report  R41536  (Washington,  DC:  Office  of 
Congressional  Information  and  Publishing,  March  13,  2012). 
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With  these  improvements  to  pipeline  security  over  the  last  decade,  the  U.S. 
pipeline  network  should  be  more  secure  than  ever.  With  the  increased  recognition  of  the 
pipeline  network  as  a  critical  infrastructure,  it  is  important  to  utilize  protection  resources 
wisely  and  in  the  most  effective  manner  possible.  This  analysis  seeks  to  provide  insight 
on  where  resources  can  be  most  useful  to  optimize  protection. 
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II.  BACKGROUND 


With  the  1860  oil  boom  in  Pennsylvania  fueling  the  world’s  appetite  for  oil,  a 
need  developed  for  an  efficient  way  to  transport  large  volumes  of  oil  to  refineries.  Early 
transportation  methods  relied  on  horse  drawn  carts  to  move  oil  filled  whiskey  barrels 
from  the  production  fields  to  river  barges  and  trains  that  then  took  the  oil  to  refineries.12 
This  method  quickly  became  impractical,  and  in  1865,  a  man  named  Van  Syckel  replaced 
the  whiskey  barrels  with  the  world’s  first  oil  pipeline.  Syckel’s  pipeline  was  six  inches  in 
diameter,  constructed  of  wood,  and  relied  on  gravity  to  move  its  80  barrel  per  hour 
capacity  five  miles.13  His  idea  spread,  and  small  pipelines,  known  as  gathering  lines, 
quickly  became  the  main  means  of  transporting  crude  over  short  distances.  While  this 
reduced  the  time  needed  to  move  the  crude  oil  to  refineries,  transportation  over  long 
distances  was  still  reliant  on  trains.14 

In  1878,  the  first  large  pipeline,  or  trunk  line,  was  built  by  the  Tidewater  Oil 
Company.  This  pipeline  was  constructed  in  secret  to  avoid  interference  by  the  powerful 
Standard  Oil  Company.  The  six-inch  iron  pipe  stretched  109  miles  over  mountainous 
terrain  and  required  an  80  horsepower  pump  to  push  the  crude  at  a  rate  of  250  barrels  per 
hour.15  Soon,  the  number  of  trunk  lines  connecting  oil  fields  to  refineries  grew,  which 
made  crude  oil  transportation  even  more  efficient. 

The  crude  oil  pipeline  infrastructure  continued  to  grow  over  the  next  several 
decades  with  the  use  of  larger  pipes  and  improved  technology.  With  the  U.S.  involvement 
in  World  War  II,  a  need  was  recognized  to  distribute  oil  across  the  nation  more 
effectively.  As  a  result,  the  War  Department  established  the  Petroleum  Administration  for 


12  BP,  “BP  Pipelines — Our  History,”  (n.d.),  http://www.bppipelines.com/history.html. 

13  BP,  “BP  Pipelines — Our  History”;  Phil  Hopkins,  “Oil  and  Gas  Pipelines:  Yesterday  and  Today,” 
2007,  www. penspen.com/Downloads/Papers/.. ./OilandGasPipelines.pdf. 

14  Samuel  T.  Pees,  “Oil  History,”  2004, 
http://www.petroleumhistory.org/OilHistory/pages/Pipelines/BigYear.html. 

15  Ida  Minerva,  The  History’  of  the  Standard  Oil  Company:  2  Volumes  in  1  (The  MacMillan  Company, 
1904);  Floyd  L.  Hartman,  “1879:  Tidewater  Pipe  Company — World’s  1st  Successful  Oil  Pipeline,”  2009, 
www.smethporthistory.org/coryville/tidewatermap.html. 
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Defense.  This  administration  created  five  Petroleum  Administration  for  Defense  Districts 
(PADDs)  across  the  United  States.  Each  PADD  oversaw  the  refining  and  distribution  of 
oil  within  its  own  district  as  shown  in  Figure  2. 16  Although  the  PADDs  were  created 
during  WWII  when  gasoline  was  rationed,  they  are  used  today  for  supply  monitoring.17 
After  Nazi  submarines  became  more  active  in  the  Atlantic  Ocean  and  sunk  several 
merchant-marine  tankers  threatening  the  east  coast’s  oil  supply,  new  crude  oil  pipelines 
were  constructed  to  make  the  PADDs  more  interconnected  and  less  vulnerable  to 
catastrophic  interruption  of  service.18  This  led  to  an  increased  reliance  on  pipelines  for 
the  delivery  of  crude  oil. 


Petroleum  Administration 
for  Defense  Districts 

padd  4: 

Rockies 

PADD  5:  PADD  2: 

VVesf  Coast.  /  /  H  h  {  .  riidjir 

AK,  HI 

PADD  1: 

Y  1  East  Coast 


PADD  3:  Gulf  Coast 


Figure  2.  Petroleum  Administration  Defense  Districts.19 


*6  National  Archives,  “Records  of  the  Petroleum  Administration  for  Defense,”  1950;  Oil  Infrastructure 
Subgroup,  “Crude  Oil  Infrastructure,”  NPC  North  American  Resource  Development  Study ,  September  15, 
2011, 

http  ://www.  google.  com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=l&ved=0CCYQFjAA&url=http%3 
A%2F%2Fwww.npc.org%2FPrudent_Development-Topic_Papers%2Fl- 

7_Crude_Oil_Infrastructure_Paper.pdf&ei=q2wxT8enGZTHsQL17IjwBg&usg=AFQjCNEj8mFdkYOysIn 

CPfGzfpveDVEWzg. 

17  Theodore  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security:  Defending  a  Networked 
Nation  (Hoboken,  NJ:  John  Wiley  &  Sons,  2006),  296. 

18  National  Archives,  “Records  of  the  Petroleum  Administration  for  Defense.” 

19  Oil  Infrastructure  Subgroup,  “Crude  Oil  Infrastructure.” 
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Since  WWII,  the  U.S.  crude  oil  pipeline  network  has  continued  to  grow  and 
become  even  more  interconnected.  It  now  stretches  over  55,000  miles  and  transports 
millions  of  barrels  of  crude  oil  per  day.20  This  large  network  supports  both  the  U.S. 
economy  and  military,  which  makes  it  one  of  the  nation’s  most  valuable  critical 
infrastructure  components. 

A.  LITERATURE  REVIEW 

The  United  States  consumes  approximately  19-20  million  barrels  per  day  (bpd)  of 
petroleum  products.21  A  complex  web  of  pipeline  infrastructure  and  water  transport 
routes  moves  crude  oil  from  where  it  is  extracted  from  the  earth  (oil  fields,  oil  basins, 
offshore  oil  fields,  and  oil  seaports  via  importation)  to  where  it  is  processed  and  refined 
for  delivery  to  the  marketplace  in  a  variety  of  forms:  gasoline,  diesel,  heating  oil,  aviation 
fuel,  lubricants,  and  raw  materials  for  the  development  of  a  variety  of  other  products  that 
this  nation  uses  every  day.  These  other  materials  include  plastics,  light  bulbs,  shoes, 
medical  equipment,  rubber,  construction  materials,  and  a  variety  of  other  products  22 

Crude  oil  pipeline  infrastructure  is  critical  to  the  North  American  energy  supply 
chain  that  has  developed  over  the  past  century.23  The  U.S.  economy  relies  almost 
completely  on  crude  oil  pipelines  as  critical  infrastructure  for  enabling  business, 
transportation,  heating  and  energy  production,  petrochemical  production,  raw  materials 
for  manufacturing,  lubrication  products,  and  hundreds  of  other  uses  critical  to  the 
American  way  of  life.  Without  crude  oil  being  delivered  on  a  daily  basis  to  refineries 
across  the  United  States  via  the  vast  complex  network  of  crude  pipelines,  the  U.S. 
economy  would  fail,  and  the  return  to  the  use  of  horse-drawn  carriages  as  a  major  mode 
of  transportation  would  be  incontrovertible.24  Crude  oil  is  delivered  to  a  complex 

20  Oil  Infrastructure  Subgroup,  “Crude  Oil  Infrastructure.” 

21  “CIA-The  World  Factbook”;  Neal  Adams,  Terrorism  &  Oil  (Tulsa,  OK  PennWell  Corp.,  2003),  32; 
Cheryl  J.  Trench,  “How  Pipelines  Make  the  Oil  Market  Work — Their  Networks,  Operation  and 
Regulation,”  December  2001,  1,  http://www.pipelinel01.com/Overview/cmde-pl.html. 

22  Adams,  Terrorism  &  Oil,  2-3. 

23  Oil  Infrastructure  Subgroup,  “Crude  Oil  Infrastructure,”  4. 

24  Adams,  Terrorism  &  Oil,  1 . 
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network  of  refineries  across  the  United  States,  whereby  the  crude  oil  is  processed  and 
refined  into  finished  products,  such  as  gasoline,  kerosene,  aviation  fuel,  and  other 
chemicals  for  delivery  to  market.  Crude  oil  itself  falls  under  the  Energy  Critical 
Infrastructure  Sector  (ECIS)  as  defined  by  the  U.S.  Department  of  Homeland  Security 
(DHS),  while  the  crude  oil  pipeline  infrastructure  falls  under  both  the  ECIS  and  the 
Transportation  Critical  Infrastructure  Sector  (TCIS).25  Without  a  stable  ECIS,  the  health 
and  welfare  is  threatened  and  the  U.S.  economy  cannot  function.26  Figure  3  shows  the 
interdependencies  of  the  18  Critical  Infrastructure  Sectors  (CIS)  and  the  criticality  of  the 
ECIS  to  all  other  sectors. 


Figure  3.  Dependence  Diagram  (Connecting  Lines  Indicate  Sector  Dependence  on 
Each  Other)  of  U.S.  Department  of  Homeland  Security  Critical 
Infrastructure  Sectors.27  Adapted  from  Lewis,  2006.28 


26  Department  of  Homeland  Security,  “DHS  Critical  Infrastructure,”  (n.d.), 
http://www.dhs.gov/files/programs/gc_1189168948944.shtm. 

26  DHS,  “DHS-Energy  Sector:  Critical  Infrastructure,”  (n.d.), 
http://www.dhs.gov/files/programs/gc_1189013411585.shtm. 

27  Department  of  Homeland  Security,  “DHS  Critical  Infrastructure.” 

28  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security:  Defending  a  Networked  Nation,  57. 
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The  price  of  crude  oil  is  set  based  on  the  market  clearing  location  for  the  COTH 
in  the  heart  of  the  midcontinent  region  of  the  United  States.  The  U.S.  crude  pipeline 
infrastructure  is  divided  into  PADDs.  Most  crude  in  PADDs  II,  III,  and  IV,  and  the  fuel 
imported  from  Western  Canada,  travels  through  the  COTH  for  redistribution  via  the  vast 
pipeline  network  to  refineries  in  PADDS  II,  III,  and  IV.29  For  most  of  the  20th  century, 
Tulsa,  Oklahoma  was  known  as  the  “Oil  Capitol  of  the  World”  and  developed  in  to  one 
of  the  most  important  hubs  in  the  oil  industry.  A  major  oil  gusher  at  Glenpool,  15  miles 
south  of  Tulsa,  was  discovered  in  1905,  which  prompted  a  rush  of  entrepreneurs  to  the 
area.30  The  Glenpool  basin  was  owned  in  large  part  by  Henry  Ford  Sinclair  and  became 
central  to  the  formation  of  the  Sinclair  Oil  Company  in  1916.  In  1907,  Oklahoma  became 
the  nation’s  largest  oil  producer.31  Major  oil  basins  at  Cushing  were  subsequently 
discovered  in  1912  and  Cushing  became  a  center  for  exploration  and  production  of 
nearby  oil  fields.  By  1914,  the  Cushing  field  was  producing  50,000  barrels  per  day,  or 
one-quarter  of  the  entire  state’s  production.32  In  1928,  the  Oklahoma  City  Field  was 
discovered  and  soon  became  the  nation’s  largest  oil  producing  basin.  From  1916-1929, 
several  major  oil  and  oil  service  entities  were  founded  in  Oklahoma,  including  Sinclair 
Oil,  Marland  Oil  (merged  with  Conoco  in  1929),  Cities  Services  Oil  Company  (now 
CITGO),  Champlin  Petroleum  Co.  (now  Champlin  Refining  Company),  Phillips 
Petroleum  Co.,  American  Association  of  Petroleum  Geologists,  Halliburton,  Noble 
Corporation,  Anderson  &  Kerr  Drilling  (Kerr-McGee,  purchased  by  Anadarko  Petroleum 
in  2005)  and  others  33  At  least  two  refineries  operated  in  Cushing.  As  nearby  oil  fields 
began  to  run  dry  in  the  1940s,  production  became  less  important  and  the  maze  of 


29  Oil  Infrastructure  Subgroup,  “Crude  Oil  Infrastructure,”  5. 

30  Wikipedia,  the  Free  Encyclopedia,  “Tulsa,  Oklahoma,”  (n.d.), 
http://en.wikipedia.org/wiki/Tulsa,  Oklahoma. 

3 1  Dan  Boyd,  “Milestones  in  the  Oklahoma  Oil  and  Gas  Industry,”  Oklahoma  Geological  Survey, 
(n.d.),  http://www.ogs.ou.edu/oilgasmilestones.php. 

32  Ibid. 

33  Ibid. 
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pipelines  and  storage  tanks  that  had  been  built  to  service  the  Cushing  refineries  began  to 
transport  crude  to  Cushing  and  other  refining  markets.34 

The  COTH  first  developed  as  an  oil-trading  center  and  then  became  the  official 
price  settlement  point  for  the  West  Texas  Intermediate  (WTI)  crude,  the  benchmark 
against  which  most  types  of  North  American  Crude  are  priced.  The  COTH  is  now  best 
known  as  a  bottleneck  for  the  energy  industry.35  For  the  past  four  decades,  the  COTH  has 
supplied  crude  oil  from  Gulf  Coast  imports  and  domestic  Mid-Continent  areas  to 
Midwest  refining  markets.36  As  such,  the  crude  pipeline  system  evolved  from  the  pre- 
WWII  era  of  mostly  distributing  domestic  supply  from  the  Mid-Continent  areas  to 
refining  markets  to  moving  both  domestic  supplies  and  Gulf  Coast  imports  to  the  interior 
of  the  country,  mostly  through  Cushing,  where  crude  could  be  redistributed  to  refineries 
across  the  Midwest.  As  supplies  from  domestic  sources  declined,  the  crude  oil  pipeline 
system  was  reversed  to  deliver  crude  oil  produced  in  Alberta,  Canada  to  the  COTH  where 
Canadian  crude  could  be  distributed  to  both  Midwest  and  Gulf  Coast  refining  markets.37 
More  recently,  other  crude  pipelines  reversed  flow  direction  due  to  increasing  domestic 
supplies  from  shale  reserves  in  North  Dakota  and  Texas,  which  brings  additional  crude 
supplies  through  the  COTH.38 

U.S.  refining  capacity  is  highly  concentrated  along  the  Gulf  Coast  between 
Galveston,  Texas  and  Baton,  Rouge,  Louisiana.  Many  petroleum  companies  have  moved 
either  corporate  or  operations  capability  to  Houston,  Texas  because  of  the  highly 
centralized  oil  activity  along  the  Gulf  Coast.  The  largest  two  refineries  in  the  United 
States  (Baytown,  Texas  and  Baton  Rouge,  Louisiana)  produce  5%  of  the  national  refined 


34  Wikipedia,  the  Free  Encyclopedia,  “Cushing,  Oklahoma,  (n.d.), 
http://en.wikipedia.org/wiki/Cushing,  Oklahoma. 

35  Matthew  Phillips,  “Unlocking  the  Crude  Oil  Bottleneck  at  Cushing,”  Business  Week,  May  16,  2012, 
http://www.businessweek.eom/articles/2012-05-16/unlocking-the-crude-oil-bottleneck-at-eushing#pl. 

36  Institute  for  Energy  Research,  “The  Booming  Sooners:  Vast  Energy,  Low  Prices,  Low 
Unemployment,”  July  11,  2012,  http://www.instituteforenergyresearch.org/2012/07/ll/those-booming- 
sooners-plentiful-energy-low-energy-prices-low-unemployment/. 

37  Ibid.;  Phillips,  “Unlocking  the  Crude  Oil  Bottleneck  at  Cushing.” 

38  Institute  for  Energy  Research,  “The  Booming  Sooners:  Vast  Energy,  Low  Prices,  Low 
Unemployment”;  Phillips,  “Unlocking  the  Crude  Oil  Bottleneck  at  Cushing.” 
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products  supply  and  the  top  10  refineries  produce  20%  of  the  total.  One  hundred  fifty-two 
refineries  are  located  in  32  states,  and  are  mostly  concentrated  in  PADDs  II,  III,  and  IV. 
The  vulnerability  and  critical  nature  of  the  refining  network  was  highlighted  in  2005 
when  Hurricane  Katrina  slammed  the  Gulf  Coast  and  interrupted  the  nation’s  energy 
supply  chain,  which  resulted  in  increased  fuel  prices  nationwide.39 

Five  of  the  top  10  producing  refineries  are  located  in  the  Gulf  Coast  geographic 
cluster  and  produce  11%  of  the  total  U.S.  supply.40  Over  the  past  decade,  the  United 
States  has  trended  away  from  its  reliance  on  waterborne  imports,  and  moved  towards 
imports  from  Western  Canada  via  crude  pipeline.  Since  1987,  imports  of  Canadian  crude 
oil  have  tripled  to  approximately  2.5  million  barrels  per  day  with  most  of  the  increase 
occurring  during  the  past  decade.41  This  shift  has  resulted  in  significant  changes  in  the 
Midwest  and  Rocky  Mountain  regions.  Many  of  the  pipeline  networks  in  these  regions 
were  established  to  supply  domestically  produced  light  crude  from  Texas  and  the  Gulf 
Coast  region  to  large  refining  hubs  in  PADD  II.  Northbound  crude  flow  from  Cushing, 
Oklahoma  and  St.  James,  Louisiana  were  once  the  backbone  of  the  crude  oil  pipeline 
infrastructure  for  the  Mid-Continent,  Gulf  Coast,  and  Midwest  regions.  Today,  they  form 
redundancy  as  flow  is  reversed  and  Canadian  crude  is  distributed  southbound  through 
Cushing  and  down  to  Texas  and  the  Gulf  Coast.42 

The  Rocky  Mountain  region  faces  the  same  situation  whereby  a  surplus  of  light 
Rocky  Mountain  crude  supply  exists,  coupled  with  increasing  availability  of  Canadian 
crude  that  resulted  in  lower  takeaway  pipeline  capacity  for  Rocky  Mountain  crude.  The 
growth  of  alternative  crude  supplies  in  PADD  II  and  increasing  Canadian  production  and 
crude  imports  is  causing  an  imbalance  in  the  traditional  crude  market  dynamics  in  the 
Gulf  Coast  region.43 


39  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security:  Defending  a  Networked  Nation, 
297-298. 

40  Ibid. 


41  Oil  Infrastructure  Subgroup,  “Crude  Oil  Infrastructure,”  7. 

42  Ibid. 

43  Ibid. 
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Both  the  East  Coast  (PADD  I)  and  the  West  Coast  (PADD  V)  remain  largely 
independent  markets  from  the  remaining  PADDs  yet  face  unique  challenges.  California 
has  no  intra-  or  inter-regional  pipeline  infrastructure,  and  the  California  Energy 
Commission  has  forecasted  the  need  for  expansive  modifications  to  waterborne  import 
facilities  and  tankage  by  2030  to  accommodate  the  state’s  increasing  crude  demands  and 
the  replacement  of  existing  import  facilities  already  past  their  useful  lives.44  The  East 
Coast  region  faces  similar  challenges. 

Despite  the  changes  in  market  dynamics,  PADD  II,  specifically  the  COTH, 
remains  the  nexus  of  the  North  American  crude  supply,  maintains  the  most  critical  crude 
pipeline  infrastructure,  and  distributes  the  vast  majority  of  the  U.S.  crude  supply  on  a 
daily  basis.  The  COTH  stores  5-11%  of  the  total  national  crude  inventory  and  serves  as 
the  price  settlement  point  for  the  benchmark  WTI  on  the  NYMEX.45  The  COTH 
distributes  approximately  14  million  barrels  per  day  and  services  several  major  pipeline 
corridors  for  the  receipt  of  oil  from  U.S.  oil  basins  or  foreign  imports  for  distribution  to 
refineries,  where  the  oil  is  then  processed  into  other  products  and  shipped  to  market.  The 
COTH  receives  imported  Canadian  crude  via  the  Keystone  pipeline  (590K  bpd)  for 
distribution  to  refineries.  The  proposed  Keystone-XL  pipeline  that  runs  from  Canada  to 
the  COTH  and  on  down  to  Port  Arthur,  Texas  would  increase  the  capacity  of  the 
Keystone  Pipeline  System  (Keystone  +  Keystone-XL)  to  1.3  million  bpd  and  serve  to 
increase  the  amount  of  crude  imported  from  Canada.  The  Keystone-XL  pipeline  will 
connect  the  COTH  to  receive  Canadian  oil  and  continue  through  Oklahoma  to  terminals 
in  Nederland,  Texas  to  serve  the  Port  Arthur,  Texas  refining  facilities.46  The  estimated 
completion  date  for  the  Keystone-XL  pipeline  is  unknown  at  this  time  due  to  President 
Obama’s  denial  of  the  pennit  for  the  construction  of  the  pipeline  that  will  transport  crude 
from  Alberta,  Canada  to  Steele  City,  Kansas  and  then  down  to  the  COTH.47  The  existing 

44  Oil  Infrastructure  Subgroup,  “Crude  Oil  Infrastructure,”  7. 

46  Ibid.,  8;  Brett  Clanton,  “Oklahoma  Oil  Hub  Helps  Keep  Oil  Prices  from  Going  Higher,”  Houston 
Chronicle,  March  3,  2011,  http://www.chron.com/business/energy/article/Oklahoma-oil-hub-helps-keep- 
oil-prices-from-going-1 550679. php. 

46  TransCanada,  “Keystone  Pipeline  Project,”  (n.d.),  http://www.transcanada.com/keystone.html. 

47  “Statement  by  the  President  on  the  Keystone  XL  Pipeline  |  The  White  House,”  (n.d.), 
http://www.whitehouse.gov/the-press-office/2012/01/18/statement-president-keystone-xl-pipeline. 
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Keystone  Pipeline,  Keystone  Cushing  Expansion  Pipeline,  and  the  proposed  route  of  the 
Keystone -XL  Pipeline  are  shown  in  Figure  4. 
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Figure  4.  The  proposed  Keystone-XL  Pipeline  Route.  The  Keystone  Cushing 
Expansion  Extended  the  Keystone  Pipeline  System  from  Steele  City, 
Kansas  to  the  COTH.  Adapted  from  TransCanada.48 


48  TransCanada,  “Keystone  Pipeline  Project.” 
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The  COTH  is  one  of  the  largest  crude  storage  facilities  in  the  world  and  the 
largest  transportation  facility  on  the  continent.  It  is  one  of  the  world’s  major  oil  terminals, 
distributing  more  than  70%  of  the  nation’s  crude  oil  on  a  daily  basis.49  The  COTH  has 
virtually  no  competition,  and  a  significant  disruption  on  the  COTH  would  be  catastrophic 
on  a  global  scale.50  The  COTH  is  unprotected  from  attack  and  fonner  CIA  director  James 
Woolsley  described  the  facility  as  not  hardened  and  an  easy  target.51  In  addition,  the 
COTH  has  already  been  identified  as  a  major  pipeline  hub  and  the  hubs  are  the  main 
source  of  vulnerability  to  the  U.S.  pipeline  systems.52 

The  COTH  is  particularly  vulnerable  to  a  catastrophic  interruption  in  service  due 
to  severe  weather  (e.g.,  Oklahoma’s  frequent  ice  storms,  floods,  and  tornados)  and/or  a 
terrorist  attack.  A  successful  appropriately  timed  terrorist  attack  in  the  midst  of  a  severe 
weather  related  event  would  result  in  widespread  negative  political,  psychological,  and 
economic  impacts  on  the  national  level.53  The  large  diameter  pipelines  coming  into  and 
leaving  the  COTH  present  the  greatest  vulnerability,  as  the  large  diameter  pipes  transport 
as  much  as  30-40  times  more  crude  than  smaller  pipelines,  but  at  the  same  time,  reduce 
the  number  of  required  pipelines.54  The  hundreds  of  storage  tanks  at  the  COTH  present 
the  next  largest  vulnerability.  An  extreme  event  (weather  event  or  terrorist  attack)  could 
significantly  disrupt  or  destroy  the  COTH.  It  is  a  critical  infrastructure  vulnerable  to 
attack  and  disruption  that  today  receives  less  than  adequate  security  consideration  by 
industry  and  government.55 

The  COTH  presents  an  optimal  target  for  terrorists.  In  March  2011,  the  Houston 
Chronicle  reported  that  the  COTH  stored  1 1%  of  the  nation’s  inventory,  which  is  double 

49  Wikipedia,  the  Free  Encyclopedia,  “Cushing,  Oklahoma.” 

50  Adams,  Terrorism  &  Oil,  108;  Anthony  L.  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack,” 
Homeland  Security’  Today,  November  27,  2007,  http://www.hstoday.us/blogs/the-kimery-report/blog/us- 
Oil-complex-vulnerable-to-attack/76d4b30a2b40c0a76d0fae629a06c50a.html. 

51  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack.,” 

52  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security’:  Defending  a  Networked  Nation, 

295. 

53  Adams,  Terrorism  &  Oil,  107-108. 

54  Ibid.,  107. 

55  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack.” 
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its  capacity  of  only  a  few  years  ago  and  was  expected  to  continue  increasing  storage 
capacity  in  the  years  to  come.  Enbridge,  owner  of  a  1,000-acre  tank  farm  at  the  COTH, 
maintains  that  the  COTH’s  future  as  a  major  oil  hub  was  promising  and  both  Enbridge 
and  other  COTH  owners  were  committed  to  the  expansion  of  the  COTH  long  into  the 
future.56 

A  single  large  bomb  the  size  of  that  used  in  the  Oklahoma  City  bombing  could 
destroy  the  COTH  complex’s  ability  to  operate  if  placed  appropriately.  Multiple  small 
bombs  or  insider  sabotage  could  have  similar  effects.  Additionally,  an  attack  against  the 
COTH  storage  tank  farms  could  be  catastrophic  from  an  environmental  and  economic 
standpoint,  as  Cushing  could  no  longer  moderate  the  supply  and  demand  and  hence, 
pricing,  for  the  U.S.  oil  industry.  A  tornado  similar  to  the  Moore,  Oklahoma  (1999)  or  the 
Joplin,  Missouri  (2011)  tornadoes  would  be  similarly  catastrophic.  A  vulnerability 
assessment  conducted  by  U.S.  Department  of  Homeland  Security  Science,  Technology, 
Engineering,  and  Math  Scholars  at  Oklahoma  State  University  found  that  the  COTH  was 
most  vulnerable  from  an  assault  to  the  site,  as  well  as  oil  storage  tanks,  pipelines, 
pumping  stations,  the  control  center,  and  utilities.  The  study  found  that  a  medium  risk 
was  associated  with  a  small  aircraft  assault  on  the  COTH,  as  the  Cushing  Municipal 
Airport  is  located  immediately  adjacent  to  the  COTH.  In  addition,  the  study  found 
multiple  readily  accessible  entry  methods.57  See  Figure  5. 


56  Clanton,  “Oklahoma  Oil  Hub  Helps  Keep  Oil  Prices  from  Going  Higher.” 

57  Donald  Furgeson,  John  Mahoney,  and  Brett  Warfield,  Security’  Vulnerability’  Assessment  of  the 
Cushing  Oil  Storage  Facility  (Stillwater,  OK:  Oklahoma  State  University,  November  30,  2011). 
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Figure  5.  Vulnerability  Assessment  Matrix  of  the  COTH.58 


58  Furgeson,  Mahoney,  and  Warfield,  Security  Vulnerability  Assessment  of  the  Cushing  Oil  Storage  Facility’. 
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A  terrorist  attack  on  the  COTH  would  lack  the  traditional  elements  of  mass 
causalities  and  iconic  buildings;  thus,  some  local  and  national  authorities  dismiss  the 
COTH  as  a  possible  terrorist  target.59  However,  the  Department  of  Homeland  Security 
Presidential  Directive  7  states,  “Terrorists  seek  to  destroy,  incapacitate,  or  exploit  critical 
infrastructure  and  key  resources  across  the  United  States  to  threaten  national  security, 
cause  mass  casualties,  weaken  our  economy,  and  damage  public  morale  and 
confidence.”60  Luft  and  Korin  maintain  that  terrorist  organizations  have  always  been 
interested  in  targeting  oil  and  gas  facilities.  In  so  doing,  these  groups  are  able  to 
undennine  the  stability  of  the  governments  and  weaken  foreign  powers  with  vested 
interests  in  their  region.  Luft  and  Korin  further  assert,  that  as  security  heightens  around 
transportation  networks,  military  bases  and  government  installations,  terrorists  looking 
for  a  big  bang  might  find  oil  interests.  To  quote  al  Qaeda,  “the  ‘umbilical  cord  and 
lifeline  of  the  crusader  community,’  the  object  of  the  next  major  assault  on  the  west,  an 
assault  that  could  wreak  havoc  with  America’s  economy  and  way  of  life.”  61  Oil  and  gas 
pipelines  have  been  a  favored  target  of  terrorists  outside  the  United  States,  and  the  fact 
that  terrorist  groups  have  demonstrated  the  capability  and  intent  to  attack  pipeline 
systems  abroad  raises  the  possibility  that  similar  attacks  could  occur  inside  the  homeland. 
Al  Qaeda’s  online  magazine,  Voice  of  Jihad,  declares  that  Al  Qaeda  “should  strike 
petroleum  interests  in  all  areas  which  supply  the  United  States.”62  This  online  magazine 
listed  The  Trans  Alaskan  Pipeline  System  as  a  target,  but  also  included  links  to  maps  of 
oil  facilities  in  Alaska,  Texas,  Louisiana,  California,  and  Oklahoma.63 


59  Anthony  L.  Kimery,  “Petrojihad  USA:  Policing  the  Pipelines Homeland  Security  Today, 
September  2007, 

http://www.hstoday.us/index.php?id=483&cHash=081010&tx_ttnews%5Btt_news%5D=556. 

60  U.S.  Department  of  Homeland  Security,  “Homeland  Security  Presidential  Directive  7:  Critical 
Infrastructure  Identification,  Prioritization,  and  Protection,”  Homeland  Security  Presidential  Directive  7, 
December  17,  2003,  http://www.dhs.gov/xabout/laws/gc_1214597989952.shtm. 

61  Gal  Luft  and  Anne  Korin,  “Terror’s  Next  Target,”  Journal  of  International  Security  Affairs 
(December  2003),  http://www.iags.org/n0111041.htm. 

62  Kimery,  “Petrojihad  USA:  Policing  the  Pipelines.” 

63  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack.” 
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Attacks  on  oil  and  gas  infrastructure  have  become  the  weapon  of  choice  for 
international  terrorists,  irrespective  of  the  political  and  social-financial  conditions  of  the 
society  under  attack.64  Over  10,000  terrorist  attacks  occurred  during  2011,  which  affected 
approximately  45,000  victims  in  70  countries  and  resulted  in  12,500  deaths.65  Data  from 
terrorist  attacks  from  2007-2011  shows  a  sharp  rise  in  the  number  of  attacks  directed  at 
energy  infrastructure,  which  includes  fuel  tankers,  fuel  pipelines,  and  electrical  networks 
that  increase  from  299  attacks  in  2010  to  438  attacks  in  2011.  During  the  same  period, 
terrorist  attacks  on  public  places  declined  approximately  47%. 66  See  Figures  6  and  7. 


Figure  6.  Terrorist  Attacks  on  Energy  Infrastructure.67 


64  Friedrich  Steinhausler  et  at,  “Security  Risks  to  the  Oil  and  Gas  Industry:  Terrorist  Capabilities,” 
Strategic  Insights  7,  no.  1  (2008):  1—1 0. 

65  National  Counterterrorism  Center,  2011  Report  on  Terrorism  (Washington,  DC:  Director  of 
National  Intelligence,  March  12,  2012). 

66  Ibid. 

67  Ibid. 
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Figure  7.  Terrorist  Attacks  on  Public  Places.68 

Over  two-thirds  of  terrorist  attacks  in  201 1  were  directed  towards  infrastructure  or 
critical  facilities.  Transportation  facilities  and  transportation  infrastructure  incurred 
damage  in  27%  of  the  2011  attacks.69  See  Figure  8.  Steinhausler  et  al.  provide  multiple 
scenarios  for  coordinated  attacks  to  the  oil  and  gas  industry  and  maintain  that  terrorists 
are  likely  to  deploy  coordinated  attacks  on  oil  infrastructure.70  A  major  interruption  of 
service  at  the  COTFI  or  other  critical  hubs  would  not  only  have  a  severe  impact  on  the 
nation’s  oil  reserves,  but  also  pose  a  significant  threat  to  an  already  suffering  economy. 
At  any  given  time,  10-11%  percent  of  the  nation’s  oil  inventory  resides  in  Cushing,  and 
this  percentage  appears  likely  to  rise.  By  the  end  of  2012,  the  added  storage  capacity  at 
the  COTH  will  increase  from  46.3  billion  barrels  to  60.3  million  barrels,  a  23.7% 
expansion.71  Seventy  percent  of  the  nation’s  crude  oil  flows  through  the  COTH.  With  the 


68  National  Counterterrorism  Center,  2011  Report  on  Terrorism. 

69  Ibid. 

70  Steinhausler  et  al.,  “Security  Risks  to  the  Oil  and  Gas  Industry:  Terrorist  Capabilities.” 

71  Furgeson,  Mahoney,  and  Warfield,  Security  Vulnerability  Assessment  of  the  Cushing  Oil  Storage 
Facility. 
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increase  in  storage  capacity  and  the  completion  of  the  Keystone-XL  pipeline,  the 
percentage  of  the  daily  supply  of  crude  oil  flowing  through  the  COTH  is  likely  to 
increase. 


Figure  8.  Terrorist  Attacks  Damaging  Facilities  by  Facility  Category.72 


The  decrees  issued  to  A1  Qaeda’s  followers  to  attack  U.S.  oil  facilities  were 
designed  with  the  intent  to  disrupt  the  flow  of  oil  available  to  America  by  bankrupting  its 
economy  by  driving  up  world  oil  prices.73  Any  disruption  to  the  flow  of  domestic  oil 
might  also  increase  U.S.  reliance  on  foreign  oil  sources,  which  are  also  vulnerable  to 
disruption  for  various  reasons.  According  to  the  U.S.  Energy  Information  Administration, 
“Both  crude  oil  and  petroleum  product  prices  can  be  affected  by  events  that  have 

72  National  Counterterrorism  Center,  2011  Report  on  Terrorism. 

73  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack.” 
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[merely]  the  potential  to  disrupt  the  flow  of  oil  and  products  to  market,  including 
geopolitical  and  weather-related  developments.”  Crude  oil  prices  and  key  geopolitical 
and  economic  events  are  represented  in  Figure  9.  Selected  events,  including  natural 
disasters,  affecting  the  price  of  crude  from  2001-2011,  are  represented  in  Figure  10. 
Furthermore,  the  EIA  indicated  that  events  only  need  to  create  uncertainty  in  oil  markets 
and  that  actual  disruptions  are  not  necessary. 

Several  major  oil  price  shocks  have  occurred  at  the  same  time  as  supply 
disruptions  triggered  by  political  events,  most  notably  the  Arab  Oil  Embargo  in  1973-74, 
the  Iranian  revolution  and  Iran-Iraq  war  in  the  late  1970s  and  early  1980s,  and  Iraq’s 
invasion  of  Kuwait  in  1990.  More  recently,  disruptions  to  supply  (or  curbs  on  potential 
development  of  resources)  from  political  events  have  been  seen  in  Nigeria,  Venezuela, 
Iraq,  Iran,  and  Libya.74 


74  U.S.  Energy  Information  Administration,  “Energy  &  Financial  Markets — U.S.  Energy  Information 
Administration  (EIA) — U.S.  Energy  Information  Administration  (EIA),”  What  Drives  Crude  Oil  Prices?, 
(n.d.),  http://www.eia.gov/fmance/markets/spot_prices.cfm. 
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Crude  oil  prices  react  to  a  variety  of  geopolitical  and  economic  events 

Crude  oil  prices  and  key  geopolitical  and  economic  events 
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Figure  9.  Geopolitical  and  Economic  Influences  on  the  Price  of  Crude  Oil  (1970— 
2010).75 


^  U.S.  Energy  Information  Administration,  “Energy  &  Financial  Markets — U.S.  Energy  Information 
Administration  (EIA) — U.S.  Energy  Information  Administration  (EIA).” 
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Figure  10.  Selected  Events  Affecting  the  Price  of  Crude  Oil  in  the  United  States  (2001—201 1)76 


76  U.S.  Library  of  Congress,  Congressional  Research  Service,  U.S.  Oil  Imports:  Context  and  Considerations,  by  Neelesh  Nerurkar,  CRS  Report 
R41765  (Washington,  DC:  Office  of  Congressional  Information  and  Publishing,  April  1,  2011),  http://www.fas.org/sgp/crs/misc/R41765.pdf. 
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In  August  1979,  the  GAO  warned,  in  a  report  to  Congress,  that  pipelines  are 
highly  vulnerable  to  disruptions  caused  by  human  error,  sabotage,  or  nature  and  that 
damage  to  facilities  on  just  a  few  pipeline  systems  could  greatly  reduce  domestic 
shipments,  which  would  cause  an  energy  shortage  exceeding  that  of  the  1973  Arab  oil 
embargo  when  severe  gas  shortages  created  long  lines  at  the  gas  pumps.77  Luft  and  Korin 
conclude  that  despite  the  fact  that  only  28%  of  American  oil  was  imported  during  the 
1973  Arab  oil  embargo,  the  supply  cuts  effect  on  the  American  economy  was  profound. 
Oil  prices  quadrupled  in  only  a  matter  of  weeks.  Today,  with  over  half  the  U.S.  crude  oil 
supply  being  imported,  the  consequences  and  attack  on  a  major  oil  installation  or  choke 
point  in  the  crude  oil  infrastructure  would  be  worse  than  the  1973  Arab  oil  embargo.78  As 
an  example  of  the  strategic  importance  of  oil  distribution,  former  CIA  Middle  East  field 
officer  Robert  Baer  provides  the  following  scenario,  which  presents  an  idea  of  the 
magnitude  of  a  scenario  in  which  oil  supply  is  interrupted  by  a  terrorist  attack  on  oil  hubs 
within  the  Kingdom  of  Saudi  Arabia: 

A  terrorist  attack... on  the  Saudi  oil  complex  or  a  simultaneous  attack  on  a 
few  of  them  is  not  a  fictional  scenario.  A  single  terrorist  cell  hijacking  an 
airplane  in  Kuwait  or  Bubai  and  crashing  it  into  Abqaiq  or  Ras  Tanura, 
could  turn  the  complex  into  an  inferno.  This  could  take  up  to  50%  of  the 
Saudi  oil  off  the  market  for  at  least  6  months  and  with  it  most  of  the 
world’s  spare  capacity,  sending  oil  prices  through  the  ceiling.  Such  an 
attack  would  be  more  economically  damaging  than  a  dirty  nuclear  bomb 
set  off  in  midtown  Manhattan  or  across  from  the  White  House  in  Lafayette 
square. .  .[this]  would  be  enough  to  bring  the  world’s  oil-addicted  economy 
to  their  knees,  America’s  along  with  them.79 

For  comparison  purposes,  a  major  disruption  (weeks  or  months)  of  the  COTH  would 
remove  approximately  70%  of  the  U.S.  crude  supply  from  the  market  because  it  serves  as 
the  major  distribution  hub  for  U.S.  crude  to  the  Midwest  and  Gulf  Coast  states,  which 
would  be  equally  consequential  as  the  scenario  proposed  by  Baer.  Former  CIA  director 
James  Woolsey  admitted  that  the  COTH  facility  is  a  “soft  target”  that  is  not  sufficiently 


77  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack.” 

78  Ibid. 

79  Ibid. 


26 


hardened  against  an  attack.  In  light  of  the  strategic  importance  of  the  COTH,  greater 
protection  seems  warranted.  The  oil  stored  in  Cushing  has  a  drastic  impact  on  crude 
pricing.  History  has  shown  that  when  reserves  at  Cushing  are  low,  prices  increase  greatly. 
Conversely,  when  stocks  are  high,  prices  plummet.  Without  a  doubt,  oil  operations  at 
Cushing  have  a  global  impact.  In  November  2007,  an  explosion  damaged  the  Lakehead 
pipeline  in  northern  Minnesota,  which  caused  oil  prices  to  spike  an  additional  four  dollars 
per  barrel.80  If  the  incident  had  disrupted  flow  of  oil  to  Cushing,  the  effect  on  the  market 
would  have  been  more  dramatic,  possibly  doubling  the  price.  The  major  disruption  of 
other  critical  hubs,  such  as  the  Houston  Ship  Channel,  Longview,  Texas;  Vernon,  Illinois; 
and  Los  Angeles  hubs  would  have  similar  consequences.  Kimery  contends  the  oil  market 
is  so  volatile  that  any  bad  news,  even  erroneous  information,  has  a  tremendous  effect  on 
pricing.81 

Critical  infrastructure  systems  represent  an  enormous  public  investment 
where  even  minor  disruptions  can  degrade  the  system’s  performance 
resulting  in  significant  economic  losses.82  It  is  well  within  the  realm  of 
reality  that  a  terrorist  or  other  organization  can  identify  critical  hubs  in  the 
U.S.  crude  pipeline  system  by  using  information  free  available  in  the  open 
source  literature.83  The  A1  Qaeda  training  manual  states  that  by  using  open 
source  information,  it  is  possible  to  gather  at  least  80%  of  information 
about  the  enemy  necessary  to  inflict  terror.84  Brown,  et  al.  of  the  Naval 
Postgraduate  School  found  that  free,  open  source  infonnation  often 
provides  100%  of  the  information  required  to  plan  a  devastating  attack  on 
an  infrastructure  system.85 

The  literature  available  regarding  the  vulnerability  and  hence,  protection,  of  the  U.S. 
crude  pipeline  infrastrcucture  is  lacking. 


80  Kimery,  “US  Oil  Complex  Vulnerable  to  Attack.” 

81  Ibid. 

82  G.  Brown  et  al.,  “Defending  Critical  Infrastructure,”  Interfaces  36,  no.  6  (November  1,  2006):  530. 

83  Ibid.,  “Al  Qaeda  Training  Manual,”  (n.d.),  http://www.fas.org/irp/world/para/manualpartl.html. 

84  “Al  Qaeda  Training  Manual.” 

85  Brown  et  al.,  “Defending  Critical  Infrastructure,”  530. 
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B. 


PROBLEM  SPACE  AND  HYPOTHESES 


Critical  infrastructure  systems  represent  an  enormous  public  investment  in  which 
even  minor  disruptions  can  degrade  the  system’s  performance  and  result  in  significant 
economic  losses.86  It  is  well  within  the  realm  of  reality  that  a  terrorist  or  other 
organization  can  identify  critical  hubs  in  the  U.S.  crude  pipeline  infrastructure  by  using 
information  free  available  in  the  open  source  literature.87’88  Consequently,  Lewis 
proposes  that  network  analysis  is  one  way  to  cope  with  size  and  complexity  of  a  complex 
system.89  A  network  analysis  of  the  U.S.  crude  infrastructure  pipeline  system  was 
conducted  to  identify  critical  components  of  the  U.S.  crude  pipeline  infrastructure.  While 
a  significant  number  of  publications  on  single  points  of  failure  with  regards  to  individual 
pipeline  components  do  exist,  network  analysis  of  the  crude  infrastructure  in  the  open 
literature  does  not. 

The  boundaries  of  this  inquiry  revolve  around  the  U.S.  crude  pipeline 
infrastructure.  Neither  refined  product  or  natural  gas  distribution  pipelines  were 
evaluated.  Refined  product  and  natural  gas  pipeline  systems  are  separate  from  the  crude 
oil  pipeline  infrastructure.  The  assumptions  made  are  that  the  crude  oil  pipeline  maps 
purchased  from  Rextag  (http://www.rextagstrategies.com)  correctly  identify  the  pipeline 
locations  that  crisscross  across  the  United  States  and  that  the  proposed  network  analysis 
program  accurately  reflects  the  U.S.  crude  pipeline  infrastructure  represented  in  a 
network  fonn. 

2.  Significance  of  Research 

The  significance  of  this  inquiry  is  that  critical  hubs  and  critical  links  can  be 
identified  in  the  crude  pipeline  infrastructure,  so  that  it  is  then  possible  to  understand 
better  how  to  protect  the  hubs  from  catastrophic  loss  due  to  natural  or  non-natural  threats. 
Network  analysis  has  been  applied  in  other  infrastructure  sections  to  identify 

86  Brown  et  at,  “Defending  Critical  Infrastructure,”  530. 

87  Ibid. 

88  “A1  Qaeda  Training  Manual.” 

89  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security:  Defending  a  Networked  Nation,  22. 
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vulnerabilities.90  The  U.S.  economy  and  other  critical  infrastructure  sectors  are 
completely  dependent  on  the  timely  and  efficient  delivery  of  crude  oil  to  refineries.  Crude 
oil  is  refined  into  a  variety  of  other  products,  such  as  gasoline,  diesel,  heating  oil,  and  jet 
fuel  and  then  delivered  to  market.  Should  the  delivery  of  a  crude  oil  distribution  system 
suffer  a  major  disruption,  the  economy  of  the  United  States  and  the  world  would  be 
significantly  affected  in  a  negative  way.  The  hubs  are  the  main  source  of  vulnerability  to 
the  U.S.  pipeline  systems.91  By  identifying  and  protecting  critical  hubs  in  the  crude 
pipeline  infrastructure,  it  is  possible  to  ensure  delivery  of  crude  oil  and  crude-based  fuels, 
products,  and  lubricants  to  maintain  the  economic  well  being  of  the  United  States. 

3.  Hypotheses 

The  hypotheses  are  the  following. 

•  The  U.S.  crude  oil  pipeline  infrastructure  is  a  complex  network  centered 
around  one  or  more  critical  hubs. 

•  The  U.S.  crude  oil  pipeline  infrastructure  is  subject  to  preferential 
attachment. 

•  The  U.S.  crude  oil  pipeline  infrastructure  is  subject  to  cascade  failure. 


90  Jian-Wei  Wang  and  Li-Li  Rong,  “Cascade-based  Attack  Vulnerability  on  the  US  Power  Grid,” 
Safety  Science  47,  no.  10  (December  2009):  1332-1336;  P.  Li  et  al.,  “A  Limited  Resource  Model  of  Fault- 
tolerant  Capability  Against  Cascading  Failure  of  Complex  Network,”  The  European  Physical  Journal  B  62, 
no.  1  (March  19,  2008):  101-104;  Eric  Taquechel,  “Layered  Defense:  Modeling  Terrorist  Transfer  Threat 
Networks  and  Optimizing  Network  Risk  Reduction,”  IEEE  Network  (November/December  2010);  Christos 
Nicolaides  et  al.,  “A  Metric  of  Influential  Spreading  During  Contagion  Dynamics  Through  the  Air 
Transportation  Network,”  PLoSOne  7,  no.  7  (July  2012):  1-10. 

91  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security:  Defending  a  Networked  Nation, 

295. 
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III.  METHOD 


The  U.S.  crude  oil  pipeline  infrastructure  was  analyzed  using  the  MBRA  software 
tool  developed  by  the  Naval  Postgraduate  School  Center  for  Homeland  Defense  and 
Security.  This  network  analysis  tool  derives  its  results  from  the  input  of  a  network  of 
nodes  and  its  respective  links  by  the  software  user. 

The  data  for  the  analysis  were  gathered  from  crude  pipeline  maps  published  by 
Rextag.  The  crude  pipeline  maps  identify  transfer  stations,  pipelines,  refinery  locations, 
liquid  storage  terminals,  and  hubs  in  the  U.S.  crude  pipeline  infrastructure.  These 
locations,  pipelines,  and  refineries  were  entered  into  the  MBRA  software  and  the  pipeline 
infrastructure  represented  as  a  network  so  that  the  network  analysis  could  be  conducted. 

The  output  of  the  MBRA  analysis  assists  the  user  in  making  objective  decisions 
about  the  various  variables  inherent  within  the  network  in  an  effort  to  reduce  risks  and/or 
vulnerability  within  the  network.  The  MBRA  approach  consists  of  two  key  components 
that  assist  the  user  in  the  analysis.  These  two  components  are  network  analysis  and  fault 
tree  analysis,  which  do  not  necessarily  have  to  be  performed  together.  For  the  study  of 
the  crude  oil  pipeline  infrastructure,  the  network  analysis  tool  was  utilized  to  determine 
which  components  of  the  network  were  most  critical.  The  critical  nodes  identified  by  the 
analysis  were  ranked  in  order  of  their  importance. 

The  MBRA  software  tool  was  chosen  for  this  study  due  to  its  indifference  in  the 
system  being  analyzed.  The  MBRA  method  can  be  utilized  on  networks  in  which  the  link 
or  nodes  are  tangible  or  intangible;  thus,  its  applications  range  from  the  analysis  of 
aqueduct  systems  to  social  networks.  The  universality  of  the  software  program  and  its 
systematic  and  methodical  approach  in  the  analysis  of  a  network  provided  enough 
support  to  choose  it  as  the  tool  to  analyze  the  crude  oil  pipeline  infrastructure  to  identify 
the  critical  nodes  in  the  network.  In  the  crude  oil  pipeline  network,  the  nodes  or  areas  of 
convergence  or  intersection  are  the  most  susceptible  to  damage  or  destruction,  either  by 
mechanical  failure,  natural  events,  or  third-party  intervention,  which  include  damage  by 
employees  or  terrorist  activities.  The  MBRA  software  tool  can  then  be  used  to  analyze 
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the  nodes’  risk  and  vulnerability  to  identify  the  critical  nodes  within  the  network.  The 
benefit  of  using  the  MBRA  is  to  minimize  risk  in  the  crude  oil  pipeline  network  while 
determining  the  most  efficient  allocation  of  funds  to  the  critical  nodes  identified  in  the 
network.92 

The  MBRA  program  estimates  a  power  curve  that  can  be  utilized  to  determine  the 
likelihood  that  a  failure  in  the  network  will  lead  to  a  cascading  failure  and  be  utilized  to 
assess  system  vulnerability.  The  MBRA  program  calculates  a  power  law  exponent,  which 
identifies  system  resiliency  against  cascade  failure. 

Exceedence  probability  curves  follow  a  power  law  and  are  commonly  used  in  the 
insurance  industry  to  assess  risk.  Power  laws  can  be  utilized  to  assess  risk  for  nearly  all 
hazards  of  interest  to  homeland  security  and  safety  engineering.  The  power  law  exponent 
dictates  the  steepness  of  the  curve.  Exponents  greater  than  one  indicate  a  resilient 
network.  In  other  words,  the  higher  the  exponent,  the  lower  the  risk.  Exponents  less  than 
one  indicate  a  network  at  risk  of  a  system-wide  cascade  failure.  In  this  case,  the  lower  the 
exponent,  the  higher  the  risk.  Power  law  curves  with  exponents  lower  than  1.0  can  be 
described  as  having  a  “fat  tail”  or  “long  tail.”  This  fat  tail  indicates  a  higher  probability  of 
network  vulnerability  to  cascade  failure.  This  vulnerability  indicates  an  increased  risk  for 
a  Black  Swan  event.  Black  swan  events  are  extreme  and  abnormal  events  responsible  for 
large  adaptations  in  nature,  as  well  as  human  and  system  evolution.93 

The  terrorist  attacks  of  9/1 1  and  the  financial  meltdown  of  2008  are  two  examples 
of  Black  Swan  events,  which  are  considered  as  such  because  of  their  low  probability, 
high  consequence,  and  vast  global  ripple  effect.  The  key  to  preventing  Black  Swans  is  to 
avoid  too  many  links  and  large  hubs  to  decrease  connectivity.  Connectivity  increases  the 


92  Taquechel,  “Layered  Defense:  Modeling  Terrorist  Transfer  Threat  Networks  and  Optimizing 
Network  Risk  Reduction.” 

93  Ted  Lewis,  Bcik's  Sand  Pile:  Strategies  for  a  Catastrophic  World  (Williams,  CA:  AGILE  Press, 
2011),  35,  48,  65;  Nassim  Nicholas  Taleb,  The  Black  Swan:  The  Impact  of  the  Highly  Improbable  (New 
York,  NY:  Random  House,  2010);  Ian  Bremmer  and  Preston  Keat,  The  Fat  Tail:  The  Power  of  Political 
Knowledge  for  Strategic  Investing  (New  York:  Oxford  University  Press,  2009). 
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probability  of  a  Black  Swan  event  because  of  ripple  effects  due  to  dependence  on 
connectedness,  which  allows  a  mechanism  for  seemingly  insignificant  events  to  magnify 
consequences.94 

The  x-axis  on  the  power  law  curves  in  Figure  10  measure  a  percentage  of  the  total 
consequence  sum  of  the  network,  and  the  y-axis  measures  the  percentage  chance  that  a 
certain  percentage  of  that  sum  will  fail.  For  example,  in  Figure  11,  a  9%  chance  exists 
that  at  least  8%  of  the  “Entire  Nation”  network  will  fail  as  the  result  of  a  single  initiating 
failure.  For  the  PADD  V  network,  note  that  an  18%  chance  exists  that  at  least  8%  of  the 
network  will  fail  as  the  result  of  a  single  initiating  failure.95 


Figure  1 1 .  Representation  of  Power  Law  Curves  and  Exceedence  Probability. 


The  analysis  will  detennine  if  the  crude  oil  infrastructure  networks  are  susceptible 
to  cascade  failure  and  define  critical  hubs  in  the  system.  This  information  can  be  utilized 
to  prepare  recommendations  to  protect  networks  and  critical  hubs  in  the  network  model. 


94  Lewis,  Bak’s  Sand  Pile:  Strategies  for  a  Catastrophic  World,  35,  90. 

95  CHDS.  “Model-Based  Risk  Analysis  User  Guide,”  (n.d.),  20-21, 
http://www.chds.us/?media/resources&collection=53&type=SIMULAT10N. 
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A. 


SOURCES  OF  DATA 


The  data  gathered  for  the  analysis  of  the  crude  oil  pipeline  infrastructure  were 
obtained  through  RexTag  Strategies.  Information  contained  within  the  maps  regarding 
the  crude  oil  pipelines  utilized  included  the  pipelines,  oil  refineries  locations,  liquid 
tenninals,  large  oil  fields,  and  oil  seaports.  The  pipelines  were  input  into  the  MBRA 
software  directly  while  the  other  information  listed  above  was  used  to  determine  the 
direction  of  oil  flow  through  the  network. 

B.  TRANSFER  OF  DATA  INTO  MBRA  SOFTWARE 

The  pipelines  were  entered  into  the  MBRA  software,  with  the  areas  of 
convergence  of  multiple  pipelines  intersecting  on  the  map  denoted  as  nodes.  Nodes  were 
placed  in  areas  where  oil  entered  the  system  and  where  they  exited  the  system,  as  in  the 
case  with  the  refineries  denoted  by  red  flags.  Nodes  were  also  identified  in  the  system 
where  pipelines  crossed  the  U.S.  border.  The  MBRA  representation  of  the  crude  oil 
pipeline  network  is  shown  in  Figure  12  and  the  representation  of  the  links,  nodes,  and 
hubs  are  depicted  in  Figure  13.  It  should  be  noted  that  with  the  use  of  the  MBRA 
software,  the  maps  within  the  software  were  used  purely  for  the  individuals  inputting  the 
information  into  the  program  and  had  no  effect  on  the  analysis  itself.  Results  derived 
from  the  MBRA  analysis  are  determined  by  the  relationship  of  the  nodes  and  links  and 
not  the  geospatial  characteristics  as  observed  on  the  map.  In  the  case  of  this  study,  it  was 
necessary  to  use  the  map  to  systematically  put  each  pipeline  in  the  MBRA  software  so  as 
to  compare  it  with  the  maps  provided  by  RexTag  Strategies  and  the  National  Geospatial- 
Intelligence  Agency  to  ensure  accuracy  and  avoid  inadvertent  omissions. 
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Figure  12.  MBRA  Representation  of  the  Crude  Oil  Pipeline  Network 


Figure  13.  Nodes,  Links,  and  Hubs,  Arrows  Indicate  Direction  of  Flow 

Assumptions  of  the  investigators  while  inputting  the  data  into  the  MBRA 
software  included  the  direction  of  flow  of  the  crude  oil  in  the  pipeline  system  and  the 
application  of  virtual  seaports.  Rigorous  investigation  into  pipeline  maps  did  not  lead  to 
the  determination  of  flow  or  pipe  diameter.  This  minor  setback  was  circumvented 
through  the  meticulous  examination  of  each  pipeline  within  the  network  and  tracing  each 
pipeline  to  its  origin  and  final  destination  (refinery  or  seaport).  The  virtual  seaports  were 
entered  into  the  MBRA  software  to  represent  the  flow  of  oil  via  ship  into  and  out  of  the 
network. 
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c. 


METHOD  OF  VALUE  ASSIGNMENT 


The  MBRA  software  models  the  effects  of  security  improvements  at  nodes,  which 
in  turn  determines  the  overall  network  risk,  but  it  does  not  provide  initial  threat, 
vulnerability,  or  consequence  inputs.96  These  values,  shown  in  Tables  1  and  2,  were 
developed  through  analysis  of  past  oil  industry  losses  and  were  inputted  in  the  MBRA 
software.  A  multiplier  was  applied  to  the  original  value  assignment  if  the  node  or  link 
were  located  or  traveled  through  a  high  consequence  area  as  identified  in  Figure  4.  These 
values  were  objectively  applied  to  each  node  and  link  within  the  entire  network.  The 
values  for  the  threat  and  vulnerability  of  each  node  and  link  inputted  into  the  system 
throughout  the  network  are  a  percentage  representing  the  probability  of  an  attack 
occurring,  and  consequently,  succeeding.  The  consequence  applied  to  each  node  and  link 
was  the  estimated  costs  of  failure  for  each  particular  component  in  the  system.  Costs  of 
component  failure  were  estimated  based  on  loss  estimates  of  a  single  Gulf  Coast  refiner 
from  both  a  3-day  and  a  10-day  interruption  of  service,  in  which  direct  (economic  losses 
to  the  refiner)  and  indirect  (losses  due  to  reduced  demand  from  suppliers  and  reduced 
sales  by  customers)  were  $97  million  (3-day  interruption)  and  $405  million  (10-day 
interruption)  per  incident.97  The  maximum  node  value  assignment  was  $20  billion,  which 
was  arrived  at  by  using  the  $20  billion  figure  BP  placed  in  escrow  to  repay  those  who  had 
losses  associated  with  the  BP/Macondo/Deepwater  Horizon  incident 98  Adjustments  for 
environmental  and  human  casualty  considerations  were  accounted  for  by  the  multipliers 
depicted  in  Table  3. 

Due  to  the  increase  of  the  consequence  because  of  location  on  a  waterway  at  the 
Houston  Ship  Cannel  hub,  the  COTH  was  given  equal  consequence  node  value 
assignments  as  those,  such  as  the  Houston  Ship  Channel  Hub  to  account  for  the  critical 

96  CHDS.  “Model-Based  Risk  Analysis  User  Guide,”  20-21. 

97  Scott  Dynes,  Eva  Andrijcic,  and  M.  Eric  Johnson,  “Costs  to  the  U.S.  Economy  of  Information 
Infrastructure  Failures:  Estimates  from  Field  Studies  and  Economic  Data,”  Proceedings  of  the  Fifth 
Workshop  on  the  Economics  of  Information  Security,  Cambridge  University,  2006, 
http://www.tuck.dartmouth.edu/cds-uploads/publications/pdf/Paper_WEIS_Costs.pdf. 

98  BP,  “BP  Establishes  $20  Billion  Claims  Fund  for  Deepwater  Horizon  Spill  and  Outlines  Dividend 
Decisionsl  Press  Release  |  BP,”  June  16,  2010, 

http://www.bp.com/genericarticle.do7categorykH20 12968&contentld=7062966. 
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nature  of  the  COTH  to  the  U.S.  pipeline  infrastructure.  The  threat  parameter  for  the 
Houston  Ship  Channel  hub  was  decreased  to  50%  because  of  the  high  activity  level  in  the 
ship  channel,  law  enforcement  presence,  and  the  significant  presence  of  industrial 
facilities  surrounding  the  Houston  Ship  Channel  Hub.  Threat  and  vulnerability 
assessments  for  the  Houston  Ship  Channel  and  the  COTH  were  conducted  with  input 
from  federal,  state,  and  local  law  enforcement  representatives  at  the  Naval  Postgraduate 
School’s  Center  for  Homeland  Defense  and  Security.  An  example  of  the  relative  threat 
level  and  vulnerability  between  the  COTH  and  Houston  Ship  Channel  is  represented  in 
Figure  14.  Virtual  seaports  nodes  were  assigned  threat  level  of  20%  and  a  vulnerability 
level  of  20  percent.  All  other  threats  and  vulnerabilities  levels  were  assigned  as  described 
in  Tables  1-3. 


Figure  14.  Houston  Ship  Channel  Oil  Transfer  and  Storage  Facility  Hub  (Left)  Is 
Located  in  an  Active  Terminal  Area  Surrounded  by  Industrial  Facilities 
and  a  Very  Busy  Waterway,  While  the  COTH  Is  Isolated  with  in  an  Area 
with  Low  Activity  and  Easy  Access  to  the  Facility 
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Degree 

Threat 

Vulnerability 

Consequence  $(millions) 

1 

20% 

100% 

25 

2 

30% 

100% 

250 

3 

40% 

100% 

500 

4 

50% 

100% 

1,000 

5  to  7 

65% 

100% 

5,000 

8  to  10 

80% 

100% 

10,000 

>10 

100% 

100% 

20,000 

Table  1.  Node  Value  Assignments 


Criteria 

Threat 

Vulnerability 

Consequence  $(millions) 

Within  1  state 

25% 

25% 

25 

Crosses  2  states 

50% 

50% 

100 

Crosses  3  states 

75% 

75% 

250 

Crosses  4  states 

100% 

100% 

500 

Table  2 .  Link  V alue  Assignments 


Consequence 

Inland  Waterway  "OR"  Coastal  ■=> 
Increased  population 


4X  (original  amount) 
4X  (original  amount) 


Table  3.  Consequence  Adjustment  Factors 
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D. 


PARAMETERS  OF  THE  ANALYSIS 


The  network  was  analyzed  using  the  parameters  of  degrees  and  betweenness,  with 
the  objective  function  of  identifying  risk.  Degrees  represent  the  number  of  links 
connected  to  a  specific  node.  The  degrees  of  each  node  were  used  to  calculate  the  overall 
impact  each  individual  node  had  on  the  system.  Betweenness  accounts  for  the  number  of 
paths  traveling  through  a  specific  node.  This  parameter  is  valuable  in  the  analysis  given 
that  a  node  with  a  small  degree  could  still  have  a  significant  impact  of  the  flow  through 
the  network  under  certain  circumstances.  Finally,  the  objective  function  of  risk  was 
selected  since  this  study  centered  on  the  identification  of  the  critical  nodes  in  the 
network.  A  separate  simulation  for  the  entire  nation  was  conducted  on  the  flow 
parameter. 


1.  Project  Assumptions/Notes 

1.  Pipelines  and  oil  basins  in  the  Gulf  of  Mexico  were  excluded  with  the 
exception  of  seaports/pipelines/terminals  where  oil  is  brought  into  the  U.S. 
pipeline  system.  Shipping  routes  crossing  into  the  coastal  United  States 
are  represented  as  a  node  on  the  coast  linked  to  the  pipeline  system. 

2.  Pipelines  crossing  Mexico/Canada  border  are  designated  as  nodes  at  the 
border  linked  to  the  pipeline  system. 

3.  Links  were  assigned  the  same  name  as  shown  on  map. 

4.  Assign  nodes  with  the  sequence  name  starting  with  a  PADD  number 
followed  by  the  node’s  numerical  sequence;  e.g.,  the  first  node  in  PADD 
V  would  be  “5.1.” 

5.  A  hub  is  defined  as  the  areas  of  convergence  at  which  multiple  pipelines 
intersect  on  the  map. 

6.  The  MBRA  network  was  based  on  the  RexTag  Map  REX-WM-030  U.S. 
Crude  Oil  Pipelines. 

7.  Liquid  storage  tenninals  are  not  included  in  the  MBRA  network. 

8.  Virtual  seaports  are  utilized  to  represent  sea  routes. 
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2.  Hypothesis  Testing 


Each  hypothesis  was  tested  using  the  following  methods. 

•  Hypothesis  1:  The  U.S.  crude  oil  pipeline  infrastructure  is  a  complex 
network  centered  around  one  or  more  critical  hubs. 

•  Testing  Method:  MBRA  Network  Analysis,  Identification  of 
Critical  Hubs 

•  Hypothesis  2:  The  U.S.  crude  oil  pipeline  infrastructure  is  subject  to 
preferential  attachment. 

•  Testing  Method:  MBRA  Network  Analysis,  Literature  Review, 
Exceedence  Probability 

•  Hypothesis  3:  The  U.S.  crude  oil  pipeline  infrastructure  system  is  subject 
to  cascade  failure. 

•  Testing  Method:  MBRA  Network  Analysis,  Exceedence 
Probability 
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IV.  RESULTS  AND  ANALYSES 


The  MBRA  software  tool  used  the  degrees  and  betweenness  of  each  node  to 
determine  the  risk  in  the  crude  oil  pipeline  infrastructure  network.  The  MBRA  analysis 
identified  the  five  most  critical  hubs  in  the  crude  oil  pipeline  network  for  the  entire 
nation.  These  critical  hubs,  identified  in  descending  order  of  criticality  are  as  follows. 

1 .  Cushing,  Oklahoma  (COTH) 

2.  Houston,  Texas  (Houston  Ship  Channel) 

3.  Vernon,  Illinois 

4.  Texas  City,  Texas 

5.  Longview,  Texas 

Another  output  of  the  MBRA  software  was  the  exceedence  probability  of  the 
network.  Exceedence  probability  follows  a  power  law,  as  recognized  in  complex  systems 
and  statistical  physics."  It  can  be  used  to  determine  the  likelihood  a  failure  in  the 
network  will  lead  to  a  cascading  failure,  or  the  probability  that  an  event  of  x  size  or  larger 
will  occur  within  a  system  and  not  simply  a  system  component.100  The  process  of 
analyzing  the  crude  oil  pipeline  network  was  applied  to  each  individual  PADD  to 
determine  its  respective  critical  nodes  and  identify  the  likelihood  of  a  cascading  failure. 
The  parameters  of  the  analysis  remained  the  same,  with  the  degrees  and  betweenness  of 
each  node  in  the  PADD  used  to  identify  the  risk  within  each  respective  network.  The 
likelihood  of  a  cascading  failure  increased  across  the  country  moving  from  PADD  I  to 
PADD  V.  The  highest  ranked  critical  node  identified  in  each  PADD  were  the  following. 

1.  PADD  I:  the  virtual  seaport  off  the  east  coast  representing  ocean-shipping 

routes 

2.  PADD  II:  Cushing,  Oklahoma  (COTH) 

3.  PADD  III:  Houston,  Texas 


"  Ian  Dobson  et  al.,  “Complex  Systems  Analysis  of  Series  of  Blackouts:  Cascading  Failure,  Critical 
Points,  and  Self-organization,”  Chaos  17,  no.  2  (2007):  1-33. 

100  Ted  Lewis,  Model-Based  Risk  Analysis  of  Complex  Networks  (Center  for  Homeland  Defense  and 
Security,  n.d.). 
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4.  PADD  IV:  Platte  County,  Wyoming 

5.  PADD  V:  Los  Angeles,  California. 

Table  4  details  the  results  of  the  exceedence  probability  for  the  crude  oil  pipeline 
network  in  each  PADD  and  the  national  network.  Results  indicate  that  PADDs  II  and  IV 
are  susceptible  to  cascade  failure  as  both  have  an  exceedence  probability  exponent  less 
than  1.  PADD  I  maintains  the  most  resilient  network,  while  the  nation’s  network 
exceedence  probability  exponent  is  1.1655. 


Exceedence  Probability  Exponent 

PADD 

Exponent 

1 

1.4909 

2 

<0.8307 

3 

1.1485 

4 

1.0257 

5 

0.3943 

Entire  Nation 

Network 

1.1655 

Table  4.  Exceedence  Probability  by  PADD 


A.  KEYSTONE-XL  PROPOSED  ROUTE 

The  Keystone-XL  proposed  route  through  Steele  City,  Kansas  down  to  the  COTH 
via  the  Keystone  Cushing  Expansion,  and  again  down  to  Nederland,  Texas  to  serve  the 
Port  Arthur,  Texas  refinery  complex  was  analyzed  in  the  MBRA  program.  The  proposed 
route  of  the  Keystone-XL  pipeline  is  depicted  in  Figure  4. 
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The  addition  of  the  proposed  Keystone-XL  route  increased  the  exceedence 
probability  exponent  from  the  current  value  of  1.1655  for  the  entire  nation  to  1.4028, 
which  indicates  a  16.9%  increase  in  network  resiliency  to  cascade  failure.  See  Figure  15. 


Entire  Nation  Entire  Nation  ♦ 

Exponent  =  1.1655  Keystone  XL  Pipeline 

Exponent  ■  1.4028 


X  Consequence  (C)  %  Consequence  (C) 


Note  the  “fat  tail”  of  the  existing  crude  oil  pipeline  network  suggesting  “long  tail”  risk  of  a  Black 
Swan  event  vs.  the  proposed  network  with  the  addition  of  the  Keystone-XL  pipeline  with  a 
tapering  “short  tail.” 

Figure  15.  Exceedence  Probability  (y-axis)  of  the  Existing  National  Crude  Oil 
Pipeline  Network  with  and  without  the  Keystone-XL  Pipeline  Proposed 
Route  Represented  in  the  Network  Analysis 


Probable  Maximum  Loss  Risk  (PMLRisk)  was  calculated  by  applying  exceedence 
probability  to  risk  assessment  science.  PMLRisk  is  the  expected  loss  due  to  a  hazard  of 
size  x  or  larger  and  is  a  worst-case  estimate  of  consequence,  rather  than  an  average-case 
estimate,  which  is  commonly  used  to  assess  risk.  Lewis  defines  PMLRisk  as:101 

PMLRisk  =  Exceedence  Probability  x  Consequence. 

The  application  of  PMLRisk  to  the  existing  U.S.  crude  oil  pipeline  infrastructure 
with  the  proposed  addition  of  the  Keystone-XL  pipeline  to  the  national  network  resulted 
in  a  PMLRisk  profile  as  described  in  Figure  16.  The  addition  of  the  Keystone-XL 


101  Lewis,  Model-Based  Risk  Analysis  of  Complex  Networks. 
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pipeline  to  the  existing  crude  oil  pipeline  infrastructure  reduces  PMLRisk  by  55% 
(PMLRisk  is  highest  at  the  highest  consequence).  The  percent  decrease  in  risk  was 
calculated  by  the  following  formula: 

Percent  Decrease  =  (PMLRisk  Existing  Network — PMLRisk  Addition  of 
Keystone-XL)/(PMLRisk  Existing  Network). 


PMLRisk  vs.  Consequence 
Crude  Oil  Pipeline  Infrastructure 


0  2  4  6  8  10 


Consequence  % 


Figure  16.  PMLRisk  vs.  Consequence  for  the  Existing  Crude  Oil  Pipeline  Network 
and  with  the  Addition  of  the  Keystone-XL  Pipeline  to  the  Network 


B.  KEYSTONE-XL  ALTERNATIVE  ROUTES 

Alternatives  were  considered  to  determine  if  re-routing  the  Keystone-XL  could 
increase  the  resiliency  of  the  nation’s  crude  network  against  cascade  failure.  Five 
alternative  routes  were  evaluated  against  the  network  with  the  Keystone-XL  proposed 
path.  Results  indicate  that  the  proposed  Keytsone-XL  path  had  the  highest  exponent  and 
presented  the  most  resilient  option.  See  Figure  13.  Route  options  are  limited  to  the  West 

by  the  Rocky  Mountain  Range  and  to  the  East  by  distance,  the  Great  Lakes,  Mississippi 
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River,  and  a  lack  of  refining  capacity.  U.S.  refining  capacity  is  highly  concentrated  along 
the  Gulf  Coast  between  Galveston,  Texas  and  Baton,  Rouge,  Louisiana.102  Table  5  lists 
the  exceedence  probability  exponent  of  each  alternative. 

The  alternative  routes  evaluated  were  the  following. 

1 .  Keystone -XL  directly  to  Houston 

2.  Keystone-XL  through  Childress,  Texas  and  Cushing  and  down  to  Houston 

3.  Keystone-XL  through  Childress  and  to  both  Cushing  and  Houston  (from 
Childress) 

4.  Keystone-XL  through  Cushing  and  down  to  Houston  (avoids  Keystone 
Cushing  Expansion  at  Steele  City,  Kansas) 

5.  Keystone-XL  through  Wood  River,  IL  and  down  to  Houston 


Exceedence  Probability  Exponent 

Alternative 

Exponent 

Actual  Proposed 
Path 

1.40 

1 

1.12 

2 

1.06 

3 

1.38 

4 

1.12 

5 

1.16 

Table  5.  Exceedence  Probability  Exponent  by  Alternative. 


102  Lewis,  Critical  Infrastructure  Protection  in  Homeland  Security:  Defending  a  Networked  Nation, 
297-298. 


45 


Regardless  of  alternative  route,  each  simulation  sequence  identified  the  COTH  as 
the  most  critical  hub  in  the  network.  See  Figure  17.  Figure  17  represents  the  critical  hubs 
identified  for  each  alternative  route  for  the  proposed  Keystone-XL  pipeline.  In  each 
instance,  the  COTH  remained  the  most  critical  hub  in  the  national  crude  oil  pipeline 
network. 
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MBRA  Critical  Nodes  (l=highest  risk) 


U.S.  Crude  Infrastructure  MBRA  Critical  Hub  Analysis 
(simulated  on  degrees,  betweenness,  cascade) 


Cushing  Hub  (  OK) 
Longview  Hub  (TX) 
Vernon  Hub  (Mo) 
Wyoming  Hub 
Childress  Hub  (TX) 
Port  Arthur  Hub  (TX) 
Houston  Hub  (TX) 


Figure  17.  Critical  Hub  Analysis  of  Existing  Network  vs.  Alternatives  Routes  for  the 
Proposed  Keystone-XL  Pipeline 
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C.  CRITICAL  HUBS  IN  INDIVIDUAL  PADDS 

MBRA  simulations  of  the  crude  oil  infrastructure  networks  within  each  individual 
PADD  were  conducted  to  detennine  the  critical  components  of  the  crude  oil 
infrastructure  network  for  each  PADD.  The  critical  components  for  each  PADD  are  as 
follows. 

1.  PADD  I 

1 .  Ocean-shipping  routes 

2.  Boca  Raton,  Florida 

3.  Portland,  Maine 

4.  Shipping  route  from  Newport,  Vermont,  where  crude  enters  the  country 
from  Canada  to  the  hub  at  Portland,  Maine 

5.  Buffalo,  New  York 

2.  PADD  II 

1 .  Cushing,  Oklahoma 

2.  Vernon,  Illinois 

3.  Chicago,  Illinois 

4.  Toledo,  Ohio 

5.  Cleveland,  Ohio 

3.  PADD  III 

1.  Houston,  Texas 

2.  Texas  City,  Texas 

3.  Singleton,  Texas 

4.  Ballinger,  Texas 

5.  Coleman,  Texas 

The  critical  hubs  for  PADD  III  are  concentrated  in  Texas,  with  the  Gulf  Coast 
region  of  Texas  being  critical  to  the  successful  operation  of  PADD  III.  See  Figure  18. 
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4.  PADD IV 

Due  to  the  lack  of  geographic  landmarks  that  would  aid  in  naming  particular  hubs 
in  the  Wyoming  area,  the  critical  hubs  in  PADD  IV  are  represented  pictorially  in  Figure 
19. 


Figure  19.  Pictoral  Representation  of  Critical  Hubs  in  PADD  IV  in  the  State  of 
Wyoming. 
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5.  PADD  V 

1 .  Long  Beach,  CA  (Los  Angeles) 

2.  Ocean  shipping  routes  Canada  and  Alaska 

3.  Crockett,  California 

4.  La  Palma,  California 

5.  Thousand  Oaks,  California 

D.  FLOW  SIMULATION 

The  MBRA  was  run  for  the  entire  nation  and  simulated  against  the  MBRA 
parameter  for  flow.  The  results  showed  an  equal  exceedence  probability  exponent  to  the 
original  simulation,  which  considered  betweenness,  degrees,  and  risk.  This  may  have 
occurred  because  actual  flow  rates  were  not  available  and  could  not  be  calculated  or 
estimated  from  the  pipeline  maps  since  pipeline  diameter  and  parallel  configurations 
were  not  provided.  Thus,  the  flow  simulation  may  not  be  a  valid  estimation  of  the  risk 
associated  with  flow  rate  in  the  national  crude  oil  pipeline  system. 

1.  Hypothesis  Testing  Results 

•  Hypothesis  1:  The  U.S.  crude  oil  pipeline  infrastructure  is  a  complex 
network  centered  around  one  or  more  critical  hubs. 

•  Result:  The  MBRA  network  analysis  identified  critical  hubs  for  the 
entire  national  network,  as  well  as  regional  networks  within  each 
PADD. 

•  Decision:  Accept  Hypothesis  1 . 

•  Hypothesis  2:  The  U.S.  crude  oil  pipeline  infrastructure  is  subject  to 
preferential  attachment. 

•  Result:  The  MBRA  network  analysis  identified  critical  hubs  for  the 
entire  national  network  whereby  new  pipelines  could  be  attached. 
Five  alternatives  routes  for  the  Keystone-XL  pipeline  were 
evaluated.  The  proposed  route  to  the  COTH  and  down  to  Houston 
provided  the  most  resilient  network  in  the  analysis. 

•  Decision:  Accept  Hypothesis  2. 
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•  Hypothesis  3:  The  U.S.  crude  pipeline  infrastructure  system  is  subject  to 
cascade  failure: 

•  Result:  The  MBRA  network  analysis  identified  PADDs  II  and  IV 
as  being  subject  to  cascade  failure.  Critical  hubs  for  the  entire 
national  network,  as  well  as  regional  networks  within  each  PADD, 
were  identified  whereby  disruption  of  the  critical  hubs  could  cause 
cascade  effects. 

•  Decision:  Accept  Hypothesis  3. 
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V.  DISCUSSION 


Pipelines  often  span  long  distances  traveling  through  remote  and  sometimes 
vulnerable  areas.  For  this  reason,  they  are  considered  soft  targets.  Protecting  all  55,000 
miles  of  the  U.S.  crude  oil  pipeline  would  be  a  daunting,  costly,  and  ultimately, 
unachievable  task.  However,  protecting  the  U.S.  crude  oil  pipeline  network  as  a  whole  is 
a  very  achievable  goal.  This  analysis  was  performed  with  the  purpose  of  identifying  the 
most  critical  parts  of  the  U.S.  crude  oil  pipeline  network.  Pipeline  operators  have  said  for 
many  years  that  what  constitutes  a  critical  asset  has  not  been  well  defined  and  is  open  to 
interpretation,  which  makes  securing  them  a  challenge.103  By  having  a  clear 
understanding  of  where  the  most  critical  parts  of  the  network  are  located,  it  is  then 
possible  to  better  protect  the  entire  network.  The  results  of  this  analysis  should  be  used  as 
a  starting  point  to  increase  the  effectiveness  of  resources  used  to  secure  the  crude  oil 
pipeline  network. 

In  parts  of  the  Middle  East,  interruptions  of  the  crude  oil  pipeline  network  are 
commonplace  as  a  result  of  terrorist  attacks.  It  does  not  require  much  in  the  form  of 
manpower  or  resources  to  successfully  attack  a  pipeline,  refinery,  or  oil  tanker.104 
Fortunately,  the  United  States  does  not  experience  these  types  of  interruptions  on  a 
regular  basis.  While  terrorism  is  always  a  threat  to  the  network,  failures  such  as  the  BP 
Texas  City  refinery  explosion  and  the  Deepwater  Horizon/BP  incident  can  be  equally  as 
damaging  but  much  more  preventable.105  Safety  and  security  are  intertwined,  and  each 
should  be  considered  when  taking  steps  to  increase  the  robustness  of  the  crude  oil 
pipeline  network.  Currently,  the  largest  threat  to  the  pipelines  in  the  network  is  corrosion, 


103  U.S.  Library  of  Congress,  Congressional  Research  Service,  Pipeline  Safety’  and  Security’:  Federal 
Programs,  by  Paul  W.  Parfomak,  CRS  Report  RL33347  (Washington,  DC:  Office  of  Congressional 
Information  and  Publishing,  Updated  February  29,  2008). 

104  Steinhausler  et  al.,  “Security  Risks  to  the  Oil  and  Gas  Industry:  Terrorist  Capabilities.” 

105  Michael  D.  Larranaga  et  al.,  Incident  Analysis:  Macondo  Prospect  252-1  Deepwater  Horizon  Well 
Control  Incident  (Boots  &  Coots  Center  for  Fire  Safety  &  Pressure  Control:  Oklahoma  State  University, 
2011);  Michael  D.  Larranaga  et  al.,  Incident  Analysis:  H1-ST1  Development  Well:  Montana  Wellhead 
Platform  Release  (Boots  &  Coots  Center  for  Fire  Safety  &  Pressure  Control:  Oklahoma  State  University, 
2011). 
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which  is  difficult  to  detect  and  can  lead  to  large  leaks  that  result  in  ecological  damage, 
monetary  loss,  and  possibly,  loss  of  life  from  ensuing  explosions.106  Maintaining  the 
structural  integrity  of  the  networks  pipelines  and  refineries  is  equally  as  important  as 
securing  the  network  from  possible  terrorist  attacks.  A  culture  of  safety  and  security  is 
crucial  to  network  integrity. 

The  results  from  the  nationwide  network  analysis  indicate  that  the  network  as  a 
whole  is  fairly  robust  and  well  designed  from  crude  delivery  standpoint.  The  analysis 
identified  several  areas  of  increased  risk  of  cascade  failure,  which  could  cause  a  large 
interruption  in  the  network  and  interrupt  delivery  to  certain  portions  of  the  country  as  a 
result  of  a  terrorist  attack,  natural  disaster,  or  other  catastrophic  event.  The  analysis 
calculated  the  exceedence  probability  of  the  network  and  the  network  within  each 
individual  PADD.  It  is  recommended  that  the  five  most  critical  nodes  in  the  national 
crude  oil  pipeline  infrastructure  be  assessed  more  thoroughly  to  ensure  they  are  not 
vulnerable.  The  network  should  also  be  assessed  to  identify  how  design  changes  could 
lessen  the  criticality  on  these  nodes  and  spread  the  risk  more  throughout  the  network.  A 
more  robust  network  would  help  lessen  the  impact  of  a  high  consequence  event  causing  a 
cascading  failure  (Black  Swan). 

The  results  indicate  that  PADD  II  and  PADD  V  are  susceptible  to  cascade  failure, 
with  PADD  V  being  the  most  vulnerable.  Due  to  the  geography  of  the  region,  PADD  V  is 
independent  from  the  rest  of  the  country.  The  isolation  of  PADD  V  combined  with  the 
realistic  scenario  of  a  cascading  event  due  to  a  terrorist  attack  or  other  catastrophic 
incident,  is  cause  for  concern  and  should  be  evaluated  further.  The  COTH  is  located  in 
PADD  II.  Considering  the  critical  nature  of  the  COTH  and  other  hubs,  it  is  recommended 
that  some  physical  barrier,  such  as  a  National  Guard  facility  or  military  base,  be 
constructed  around  the  COTH  to  prevent  a  terrorist  attack  and  provide  resources  for  a 
large-scale  response  to  the  COTH.  This  type  of  physical  barrier  would  limit  access  to  the 
COTH,  an  increased  law  enforcement  presence  associated  with  facilities  of  this  type,  an 
increased  fire  department  response  capability,  and  simply,  an  increase  in  the  number  of 

106  Parker  “The  Pipeline  Industry  Meets  Grief  Unimaginable:  Congress  Reacts  with  the  Pipeline 
Safety  Improvement  Act  of  2002.” 
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security-vetted  personnel  able  to  observe  facility  boundaries.  Undoubtedly,  local  citizens, 
environmental  groups,  many  politicians,  and  others  would  view  this  disruptive  suggestion 
negatively.  However,  the  catastrophic  loss  of  the  COTH  and  other  critical  hubs  within  the 
crude  oil  pipeline  network  would  lead  to  long-standing  and  negative,  political,  economic, 
and  social  implications  that  likely  outweigh  negative  factors  associated  with  leaving  the 
hubs  vulnerable.  Regardless  of  whether  this  recommendation  is  accepted  or  not, 
hardening  with  regards  to  security  of  the  COTH  and  critical  hubs  in  each  PADD,  should 
be  completed  to  protect  against  catastrophic  interruption  of  service  from  terrorist  attack. 

This  hardening  of  critical  hubs  should  include  components  of  the  concept  of 
Integrated  Physical  Protection  (IPT)  consisting  of  the  following.107 

1 .  State-of-the-art  technical,  and  operational  countermeasures  to  enable 
management  to  reduce  the  probability  of  success  of  a  terror  attack. 

2.  Increased  emphasis  on  a  corporate  security  culture,  and  thereby, 
strengthen  corporate  resilience  to  consequences  of  a  terror  attack  and 
minimize  the  insider  threat. 

3.  Continuous  security  training  at  all  levels  to  reduce  the  probability  for  the 
occurrence  of  a  terror  attack  and  to  reduce  downtime  after  a  terror  attack. 

4.  Regular  threat  and  risk  assessment  activities  to  identify,  qualify,  and 
quantify  risks  and  countenneasures  in  a  changing  and  complex 
environment. 

5.  Evaluation  and  update  of  strategies  and  countermeasures  based  on  risk 
analyses  by  considering  the  cost  benefit  factor. 

6.  Strengthen  cooperation  between  private  owners  of  the  facilities,  related 
government  security  agencies,  law  enforcement,  and  first  responders. 

The  addition  of  the  proposed  Keystone-XL  pipeline  increases  the  resiliency  of  the 
crude  oil  pipeline  infrastructure  against  cascade  failure  and  significantly  reduces  the 
PMLRisk  associated  with  a  Black  Swan  event.  Hence,  the  potential  for  a  catastrophic  loss 
of  U.S.  capacity  to  distribute  oil  to  refineries  throughout  the  United  States  is  greatly 
reduced  by  the  addition  of  the  Keystone-XL  pipeline  to  the  network.  The  Obama 
Administration  should  reconsider  its  controversial  denial  of  a  permit  to  complete  the 
Keystone-XL  pipeline  that  will  carry  oil  from  Alberta,  Canada  to  the  COTH. 


107  Steinhausler  et  at,  “Security  Risks  to  the  Oil  and  Gas  Industry:  Terrorist  Capabilities.” 
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A. 


STRENGTHS/WEAKNESSES  OF  MBRA 


A  major  advantage  of  using  the  MBRA  method  is  that  it  directs  attention  to  the 
most  critical  areas  in  a  network  subsequently  to  aid  in  minimizing  those  areas  at  greatest 
risk  from  disruption.  Consequently,  a  potential  disadvantage  is  that  this  process  could 
overlook  smaller  links  and  nodes  in  the  system.  With  a  majority  of  the  focus  being  on  the 
critical  nodes  following  the  analysis,  the  smaller  components  in  the  system  could  be  left 
vulnerable  to  degradation  or  attack  with  the  potential  of  cascading  effects  within  the 
system. 

Another  disadvantage  in  the  analysis  of  the  network  is  that  the  MBRA  program 
does  not  allow  for  the  representation  of  the  multiple  lines,  in  this  case,  pipelines  running 
in  parallel,  originating  and  tenninating  at  identical  nodes.  This  insufficiency  has  the 
potential  to  influence  the  output  of  the  analysis  adversely  given  that  one  of  the  parameters 
of  the  model  analysis  is  degrees  (or  number  of  pipelines  that  connect  to  individual 
nodes).  This  parameter  of  the  analysis  calculates  the  number  of  links  entering  and  leaving 
each  node  in  the  network  to  detennine  its  significance  within  the  system.  Another 
weakness  of  the  program  is  its  lack  of  identification  of  the  source  and  sink  nodes  in  the 
network  that  would  be  useful  to  the  analysis  due  to  the  higher  significance  these 
components  play  in  the  actual  system. 

Regardless  of  the  weaknesses,  the  MBRA  network  modeling  and  analysis  tool 
provides  valuable  insight  into  the  risks  associated  with  attack  vulnerability  and  cascade 
failure  of  a  network  system.  The  MBRA  tool  provides  a  mechanism  to  compute  probable 
maximum  loss  risk.  Network  modeling  is  perhaps  the  simplest  method  of  representing 
and  analyzing  systems  of  all  sizes,  regardless  of  their  complexity  while  embracing  system 
components  and  relationships  among  components.  In  addition,  the  MBRA  calculates 
exceedence  probabilities  of  cascade  failure  within  a  system.  This  calculation  is  ideal 
because  network  failures  are  systemic  and  cascade  failures  commonly  occur  in  complex 
systems,  such  as  power  grids,  nuclear  power  plants,  telecommunication  systems,  and 
Internet  exploits.108  As  such,  the  results  of  this  study  suggest  that  emphasis  should  be 

108  Lewis,  Model-Based  Risk  Analysis  of  Complex  Networks. 
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placed  on  critical  hubs  to  protect  the  entire  network  from  cascade  failure.  It  is  not 
suggested  that  any  other  component  of  the  nation’s  crude  pipeline  infrastructure  be 
ignored  from  either  a  security  or  safety  standpoint. 
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VI.  CONCLUSION 


Much  of  the  crude  oil  pipeline  infrastructure  is  vulnerable  to  catastrophic  failure 
and  has  served  beyond  its  intended  design  life.  Protecting  all  55,000  miles  of  the  U.S. 
crude  oil  pipeline  infrastructure  from  catastrophic  failure  is  an  unachievable  goal. 
Protection  of  the  network  can  be  achieved  by  protecting  hubs  from  catastrophic  failure, 
allocating  resources  to  critical  hubs,  and  by  employing  the  concepts  of  integrated 
physical  protection.  In  addition  to  protecting  the  five  most  critical  hubs  in  the  entire  U.S. 
crude  oil  pipeline  network,  critical  hubs  in  each  PADD  should  be  protected. 

The  resiliency  of  the  crude  oil  pipeline  infrastructure  is  vital  to  sustain  the  U.S. 
economy,  military,  and  standard  of  living.  The  analysis  has  identified  key  areas  within 
the  network  that  require  additional  attention  to  ensure  their  integrity.  A  key  concept  to 
alleviate  the  risk  across  a  network  is  to  incorporate  redundancy  through  the  design  of 
additional  hubs  positioned  strategically  across  the  network.  The  completion  of  the 
Keystone -XL  pipeline  from  Canada  through  the  COTH  and  down  to  Nederland,  Texas 
will  improve  the  resiliency  of  the  network  and  reduce  the  risk  associated  with  a  Black 
Swan  event.  Further  analysis  should  be  conducted  to  explore  alternative  and  additional 
pipelines  to  accomplish  this  effort.  Also,  by  increasing  safety  across  the  network  by  the 
individual  pipeline  operators,  security  of  the  infrastructure  will  be  enhanced.  By  focusing 
resources  on  the  identified  critical  areas,  the  network  as  a  whole  will  become  more 
resilient  to  disruption  by  a  terrorist  attack,  natural  disaster,  or  other  catastrophic  events. 
The  results  of  this  analysis  should  be  used  as  a  starting  point  to  increase  network 
resiliency  and  prioritize  the  use  of  resources  to  secure  the  crude  oil  pipeline  network 
against  cascade  failure  and  a  Black  Swan  event. 
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